| Summary: | CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Petr Matousek <pmatouse> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anton, arozansk, bhu, davej, dhoward, fhrbata, jkacur, kernel-mgr, kmcmartin, lgoncalv, lwang, plougher, rt-maint, sforsber, tcallawa, vgoyal, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-05-10 13:26:41 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 692709, 738299, 738300, 738301, 738302, 738303, 748687, 761369 | ||
| Bug Blocks: | 738297 | ||
Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6, and Red Hat Enterprise MRG. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1479.html, https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html. I believe this also requires: commit 221d1d797202984cb874e3ed9f1388593d34ee22 cifs: add fallback in is_path_accessible for old servers Created kernel tracking bugs for this issue Affects: fedora-all [bug 748687] This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:1465 https://rhn.redhat.com/errata/RHSA-2011-1465.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:1479 https://rhn.redhat.com/errata/RHSA-2011-1479.html This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2012:0010 https://rhn.redhat.com/errata/RHSA-2012-0010.html |
Currently, we skip doing the is_path_accessible check in cifs_mount if there is no prefixpath. There is a report of at least one server however that allows a TREE_CONNECT to a share that has a DFS referral at its root. UNC that had no prefixpath was used in that case, so the is_path_accessible check was not triggered and the box later hit a BUG() because we were chasing a DFS referral on the root dentry for the mount. Upstream fix: 70945643722ffeac779d2529a348f99567fa5c33 References: https://bugzilla.redhat.com/show_bug.cgi?id=682829 https://github.com/torvalds/linux/commit/70945643722ffeac779d2529a348f99567fa5c33 Acknowledgements: Red Hat would like to thank Yogesh Sharma for reporting this issue.