Bug 579445 (CVE-2010-1148) - CVE-2010-1148 kernel: cifs: skip posix open if nameidata is null
Summary: CVE-2010-1148 kernel: cifs: skip posix open if nameidata is null
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-1148
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 579446 579447
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-05 08:42 UTC by Eugene Teo (Security Response)
Modified: 2021-11-12 20:05 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-04-28 00:37:58 UTC
Embargoed:

Attachments (Terms of Use)

Description Eugene Teo (Security Response) 2010-04-05 08:42:17 UTC 
Description of problem:
From me, while creating a file on a server which supports unix extensions such as Samba, if a file is being created which does not supply nameidata (i.e. nd is null), cifs client can oops when calling cifs_posix_open.

http://comments.gmane.org/gmane.linux.file-systems.cifs/5782
Comment 2 Eugene Teo (Security Response) 2010-04-09 07:18:50 UTC 
[linux-cifs-client[[patch] Attempt #2 to handle null nameidata
http://old.nabble.com/-linux-cifs-client--patch--Attempt--2-to-handle-null-nameidata-td28167381.html
Comment 3 Eugene Teo (Security Response) 2010-04-28 00:37:58 UTC 
Not vulnerable. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5 and Red Hat Enterprise MRG as they did not include support for posix opens on lookup.
Comment 5 Eugene Teo (Security Response) 2010-06-07 06:12:37 UTC 
Upstream commit:
http://git.kernel.org/linus/fa588e0c57048b3d4bfcd772d80dc0615f83fd35
Note You need to log in before you can comment on or make changes to this bug.