oss-security - CVE-2010-2524 kernel: dns_resolver upcall security issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C563FEA.6010901@kernel.sg>
Date: Mon, 02 Aug 2010 11:47:54 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE-2010-2524 kernel: dns_resolver upcall security issue

CIFS has the ability to chase MS-DFS referrals. In order to do this it 
has to be able to resolve hostnames into IP addresses. For this, it uses 
the keys API to upcall to the cifs.upcall userspace helper. It then 
resolves the name and hands the address back to the kernel.

The dns_resolver upcall currently used by CIFS is susceptible to cache
stuffing. It's possible for a malicious user to stuff the keyring with 
the results of a lookup, and then trick the server into mounting a 
server of his choosing.

I have assigned this with CVE-2010-2524. To be susceptible to this, you 
need CONFIG_CIFS_DFS_UPCALL enabled. Interesting bug.

https://bugzilla.redhat.com/CVE-2010-2524

Upstream commit:
http://git.kernel.org/linus/4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7

Thanks, Eugene
-- 
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.