From patchwork Fri Feb 10 10:14:29 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Bader X-Patchwork-Id: 140550 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id F3898B6EF7 for ; Fri, 10 Feb 2012 21:14:47 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RvnUu-0007Sh-FR; Fri, 10 Feb 2012 10:14:32 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RvnUs-0007Sb-Q5 for kernel-team@lists.ubuntu.com; Fri, 10 Feb 2012 10:14:30 +0000 Received: from p5b2e45df.dip.t-dialin.net ([91.46.69.223] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1RvnUs-0003EW-Ij for kernel-team@lists.ubuntu.com; Fri, 10 Feb 2012 10:14:30 +0000 From: Stefan Bader To: kernel-team@lists.ubuntu.com Subject: [CVE-2011-4324] BUG statement in default case of encode_share_access Date: Fri, 10 Feb 2012 11:14:29 +0100 Message-Id: <1328868869-6170-1-git-send-email-stefan.bader@canonical.com> X-Mailer: git-send-email 1.7.5.4 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com CVE-2011-4324: User can cause BUG on NFS4 mounted FS via mknod Fix has hit Lucid and later via mainline. The upstream patch for that is a bigger rewrite replacing access modes by the fmode_t which was not present before 2.6.28. Suggesting a minimal backport for Hardy. --- From af41fdc3d7c5d68ec75845d15f9ef4c77b31d110 Mon Sep 17 00:00:00 2001 From: Stefan Bader Date: Fri, 10 Feb 2012 11:00:49 +0100 Subject: [hardy CVE] UBUNTU: SAUCE: Return deny all as default in encode_share_access This used to be catched by BUG() which is not only unnecessary. It was changed as part of a bigger rewrite that depends on a typedef which does not exist before 2.6.28. CVE-2011-4324 BugLink: http://bugs.launchpad.net/bugs/917829 (very loosely backported from dc0b027dfadfcb8a5504f7d8052754bf8d501ab9) Signed-off-by: Stefan Bader --- fs/nfs/nfs4xdr.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index 51dd380..cc66519 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -967,7 +967,7 @@ static void encode_share_access(struct xdr_stream *xdr, int open_flags) WRITE32(NFS4_SHARE_ACCESS_BOTH); break; default: - BUG(); + WRITE32(0); } WRITE32(0); /* for linux, share_deny = 0 always */ }