79672 : Linux Kernel CIFS FIFO File Handling Local DoS
Printer | http://osvdb.org/79672 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
5	597	about 1 year ago	5 months ago	6 times	100%

Timeline

Disclosure Date
2012-02-23

Time to Patch
13 days

Description

Linux Kernel contains a flaw in the Common Internet File System (CIFS) component that may allow a local denial of service. The issue is due to an error in the cifs_lookup function in fs/cifs/dir.c. With an attempted access to a samba share, a local attacker can crash the systems of users that have access to the same samba share.

Classification

Location: Local Access Required
Attack Type: Denial of Service
Impact: Loss of Availability
Solution: Upgrade
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

It has been reported that this issue has been fixed. Upgrade to version 3.2.10, or higher, to address this vulnerability.

Products

Linux Kernel Organization, Inc.

Linux Kernel

3.2.9

References

CVE ID: 2012-1090 (see also: NVD)
Secunia Advisory ID: 47482 48523 48544 48842 48889 48914 48964 48987 49027 49069 49178 49262 49355 49736 51188
Bugtraq ID: 52197
Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-updates/2012-11/msg00002.html
http://wiki.openvz.org/Download/kernel/rhel6/042stab055.10
http://www.debian.org/security/2012/dsa-2443
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10
http://www.ubuntu.com/usn/usn-1405-1
http://www.ubuntu.com/usn/usn-1425-1/
http://www.ubuntu.com/usn/usn-1426-1/
http://www.ubuntu.com/usn/usn-1431-1/
http://www.ubuntu.com/usn/usn-1432-1/
http://www.ubuntu.com/usn/usn-1433-1/
http://www.ubuntu.com/usn/usn-1440-1/
http://www.ubuntu.com/usn/usn-1458-1/
https://bugzilla.redhat.com/show_bug.cgi?id=798293
https://github.com/torvalds/linux/commit/88d7d4e4a439f32acc56a6d860e415ee71d3df08
https://hermes.opensuse.org/messages/14306635
https://hermes.opensuse.org/messages/14566472
https://hermes.opensuse.org/messages/15023693
Mail List Post: http://thread.gmane.org/gmane.linux.kernel.cifs/5526
Vendor URL: http://www.kernel.org/
Other Advisory URL: http://www.openwall.com/lists/oss-security/2012/02/28/4
RedHat RHSA: RHSA-2012:0481

Credit

CAI Qian

CVSSv2 Score

CVSSv2 Base Score = 4.9
Source: nvd.nist.gov | Generated: 2012-05-17 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.