The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an NFSv4 mount request.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 7.8 | HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Not vulnerable. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5, or Red Hat Enterprise MRG. Those versions do not include the upstream patch that introduced this vulnerability.
| Hyperlink | Source | Resource |
|---|---|---|
| http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=80fc015bdfe1f5b870c1e1ee02d78e709523fee7 | secalert@redhat.com | N/A |
| http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=886e3b7fe6054230c89ae078a09565ed183ecc73 | secalert@redhat.com | N/A |
| http://marc.info/?l=oss-security&m=125618753029631&w=2 | secalert@redhat.com | N/A |
| http://marc.info/?l=oss-security&m=125624036516377&w=2 | secalert@redhat.com | N/A |
| http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.2 | secalert@redhat.com | N/A |
| http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc1 | secalert@redhat.com | N/A |
| http://www.ubuntu.com/usn/usn-864-1 | secalert@redhat.com | N/A |
| https://bugzilla.redhat.com/show_bug.cgi?id=530269 | secalert@redhat.com | N/A |