Home page logo
/

oss-sec logo oss-sec mailing list archives

Linux kernel libceph NULL function pointer dereference (CVE-2013-1059)
From: Tyler Hicks <tyhicks () canonical com>
Date: Tue, 9 Jul 2013 12:03:40 -0700

Chanam Park discovered that a crafted auth_reply message could cause a
NULL function pointer dereference in the libceph auth_none handler. A
remote attacker could use this flaw to cause a denial of service.

If a malicious Ceph monitor sends an auth_reply message with the value
of -EAGAIN in the result field, ceph_build_auth_request() will call the
ceph_auth_client_ops->build_request() function pointer without checking
to see if the build_request() pointer is NULL. The auth_none handler
does not initialize its build_request() pointer.

See http://hkpco.kr/advisory/CVE-2013-1059.txt for more information.

The fix can be found in the upstream ceph-client.git tree:

https://git.kernel.org/cgit/linux/kernel/git/sage/ceph-client.git/commit/?id=2cb33cac622afde897aa02d3dcd9fbba8bae839e

Tyler

Attachment: signature.asc
Description: Digital signature


  By Date           By Thread  

Current thread:
  • Linux kernel libceph NULL function pointer dereference (CVE-2013-1059) Tyler Hicks (Jul 09)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]