oss-sec mailing list archives
Re: CVE request - kernel: nfsd: fix vm overcommit crash
From: Josh Bressers <bressers () redhat com>
Date: Wed, 26 May 2010 14:45:34 -0400 (EDT)
Please use CVE-2010-1643 for this. Thanks. -- JB ----- "Eugene Teo" <eugeneteo () kernel sg> wrote:
"knfsd crashes if you are using it to export shmemfs objects and run strict overcommit. In this situation the current->mm based modifier to the overcommit goes through a NULL pointer. We could simply check for NULL and skip the modifier but we've caught other real bugs in the past from mm being NULL here - cases where we did need a valid mm set up (eg the exec bug in 2005). To preserve the checks and get the logic we want shuffle the checking around and add a new helper to the vm_ security wrappers Also fix a current->mm reference in nommu that should use the passed mm" Upstream commit: nfsd: fix vm overcommit crash http://git.kernel.org/linus/731572d39fcd3498702eda4600db4c43d51e0b26 Reference: [PATCH] knfsd: add nfs-export support to tmpfs http://git.kernel.org/linus/91828a405ae454a9503c41a7744f6ff877a80714 https://bugzilla.redhat.com/show_bug.cgi?id=595970 Backtrace (-rt kernel): https://bugzilla.redhat.com/show_bug.cgi?id=595970#c1 Thanks, Eugene -- main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }
Current thread:
- CVE request - kernel: nfsd: fix vm overcommit crash Eugene Teo (May 25)
- Re: CVE request - kernel: nfsd: fix vm overcommit crash Josh Bressers (May 26)
- Re: CVE request - kernel: nfsd: fix vm overcommit crash Eugene Teo (May 26)
- Re: CVE request - kernel: nfsd: fix vm overcommit crash Josh Bressers (May 26)