CVE-2011-4324

[John Johansen]

The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem.

Break-Fix: - dc0b027dfadfcb8a5504f7d8052754bf8d501ab9

[John Johansen (jjohansen)]

CVE-2011-4324

[Stefan Bader (smb)]

Did install nfs-kernel-server and export a dir via 127.0.0.1, then mounted that as nfs4 mount and run the following code in that dir (touch can normally create files):

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>

int main(void)
{
        int fd;

        fd = mknod("bla", S_IFREG, 0);

        if(fd >= 0)
                close(fd);
        return 0;
}

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.24-31.99

---------------
linux (2.6.24-31.99) hardy-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #931627

  [Andy Whitcroft]

  * debian -- validate patches are applied to openvz etc

  [Stefan Bader]

  * SAUCE: Return deny all as default in encode_share_access
    - LP: #917829
    - CVE-2011-4324

  [Tim Gardner]

  * [Config] Generate patch set from flattened sources
  * [Config] Added apply-patch-to-binary-custom
  * [Config] Flattened openvz
  * [Config] Flattened xen

  [Upstream Kernel Changes]

  * sound/oss: remove offset from load_patch callbacks
    - LP: #925337
    - CVE-2011-1476
  * sound/oss/opl3: validate voice and channel indexes
    - LP: #925335
    - CVE-2011-1477
  * Fix for buffer overflow in ldm_frag_add not sufficient
    - LP: #922371
    - CVE-2011-2182
  * Move "exit_robust_list" into mm_release()
    - LP: #927889
    - CVE-2012-0028
  * futex: Nullify robust lists after cleanup
    - LP: #927889
    - CVE-2012-0028
 -- Herton Ronaldo Krzesinski <email address hidden> Mon, 13 Feb 2012 17:25:53 -0200