News
Vigil@nce: Linux kernel, denial of service via NFS
March 2010 by Vigil@nce
SYNTHESIS OF THE VULNERABILITY
An attacker can truncate a NFS file, in order to stop the kernel, and possibly to execute code.
Severity: 2/4
Consequences: administrator access/rights, denial of service of computer
Provenance: intranet client
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 03/03/2010
IMPACTED PRODUCTS
Linux kernel
DESCRIPTION OF THE VULNERABILITY
The nfs_wait_on_request() function of the fs/nfs/pagelist.c file waits for the end of a query on a NFS filesystem.
When a file is truncated, this function can be prematurely interrupted, which forces a write in an invalid memory page.
An attacker can therefore truncate a NFS file, in order to stop the kernel, and possibly to execute code.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-9489
