oss-sec mailing list archives
CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback client
From: Eugene Teo <eugeneteo () kernel sg>
Date: Thu, 22 Oct 2009 12:58:21 +0800
Quoting from upstream patch: "On setting up the callback to the client, we attempt to use the sameauthentication flavor the client did. We find an rpc cred to use by calling rpcauth_lookup_credcache(), which assumes that the given authentication flavor has a credentials cache. However, this is not required to be true--in particular, auth_null does not use one. Instead, we should call the auth's lookup_cred() method.
Without this, a client attempting to mount using nfsv4 and auth_null triggers a null dereference."
The code was introduced in upstream commit 3cef9ab2 (v2.6.31-rc1), fixed in 886e3b7f (v2.6.32-rc1), and was later replaced by 80fc015b in the same version.
References: http://article.gmane.org/gmane.linux.nfs/26513 https://bugzilla.redhat.com/show_bug.cgi?id=530269 http://git.kernel.org/linus/3cef9ab266a932899e756f7e1ea7a988a97bf3b2 http://git.kernel.org/linus/886e3b7fe6054230c89ae078a09565ed183ecc73 http://git.kernel.org/linus/80fc015bdfe1f5b870c1e1ee02d78e709523fee7 Thanks, Eugene
Current thread:
- CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback client Eugene Teo (Oct 21)
- Re: CVE request: kernel: nfsd4: fix null dereference creating nfsv4 callback client Josh Bressers (Oct 22)