Bug 488196 - kernel: selinux: selinux_netlbl_inode_permission() null pointer deref
Summary: kernel: selinux: selinux_netlbl_inode_permission() null pointer deref
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 488200 488201 488202
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-03-03 06:08 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:28 UTC (History)
12 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-03-06 01:33:42 UTC
Embargoed:

Attachments (Terms of Use)
Upstream patch (1.33 KB, patch)
2009-03-03 06:15 UTC, Eugene Teo (Security Response) 		no flags Details | Diff
View All

Description Eugene Teo (Security Response) 2009-03-03 06:08:41 UTC 
Description of problem:
Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission() caused by a certain sequence of SUNRPC operations. The problem appears to be due to the lack of NULL pointer checking in the function; the patch for this issue adds the pointer checks so the function will exit safely in the cases where the socket is not completely initialized.
Comment 1 Eugene Teo (Security Response) 2009-03-03 06:15:20 UTC 
Created attachment 333839 [details]
Upstream patch

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d7f59dc4642ce2fc7b79fcd4ec02ffce7f21eb02
Comment 10 Eugene Teo (Security Response) 2009-03-06 01:33:42 UTC 
It appears that the problem is caused by the test case/out of tree code. The problem is not in the selinux or the netlabel code. Closing bugs.
Note You need to log in before you can comment on or make changes to this bug.