oss-security - Re: CVE request - kernel: nfsd: fix vm overcommit crash

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <390300551.388131274899534089.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 26 May 2010 14:45:34 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: nfsd: fix vm overcommit
 crash

Please use CVE-2010-1643 for this.

Thanks.

-- 
    JB

----- "Eugene Teo" <eugeneteo@...nel.sg> wrote:

> "knfsd crashes if you are using it to export shmemfs objects and run 
> strict overcommit. In this situation the current->mm based modifier to
> 
> the overcommit goes through a NULL pointer.
> 
> We could simply check for NULL and skip the modifier but we've caught
> 
> other real bugs in the past from mm being NULL here - cases where we
> did 
> need a valid mm set up (eg the exec bug in 2005).
> 
> To preserve the checks and get the logic we want shuffle the checking
> 
> around and add a new helper to the vm_ security wrappers
> 
> Also fix a current->mm reference in nommu that should use the passed
> mm"
> 
> Upstream commit:
> nfsd: fix vm overcommit crash
> http://git.kernel.org/linus/731572d39fcd3498702eda4600db4c43d51e0b26
> 
> Reference:
> [PATCH] knfsd: add nfs-export support to tmpfs
> http://git.kernel.org/linus/91828a405ae454a9503c41a7744f6ff877a80714
> https://bugzilla.redhat.com/show_bug.cgi?id=595970
> 
> Backtrace (-rt kernel):
> https://bugzilla.redhat.com/show_bug.cgi?id=595970#c1
> 
> Thanks, Eugene
> -- 
> main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i);
> }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.