Bug 851103 (CVE-2013-4591) - VUL-1: CVE-2013-4591: kernel: nfs missing check for buffer length
Summary: VUL-1: CVE-2013-4591: kernel: nfs missing check for buffer length
Status: RESOLVED FIXED
Alias: CVE-2013-4591
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2013-12-26
Assignee: E-mail List
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sle11-sp1:55587 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-19 14:18 UTC by Victor Pereira
Modified: 2016-04-27 19:10 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2013-11-19 14:18:02 UTC 
CVE-2013-4591

commit 1f1ea6c (included in Red Hat Enterprise Linux 6 as part of CVE-2012-2375 fix) accidently dropped the checking for too small result buffer length.
   
If someone uses getxattr on "system.nfs4_acl" on an NFSv4 mount supporting ACLs, the ACL has not been cached and the buffer suplied is too short, we still copy the complete ACL, resulting in kernel and user space memory corruption.


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4591
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f1ea6c2d9d8c0be9ec56454b05315273b5de8ce
https://bugzilla.redhat.com/show_bug.cgi?id=1031678
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7d3e91a89b7adbc2831334def9e494dd9892f9af
http://comments.gmane.org/gmane.comp.security.oss.general/11511
Comment 1 Swamp Workflow Management 2013-11-19 23:00:35 UTC 
bugbot adjusting priority
Comment 2 Marcus Meissner 2013-12-06 15:34:03 UTC 
neil, perhaps for you
Comment 17 Neil Brown 2014-03-14 00:20:51 UTC 
This bug is not present in any of out kernels.
I'm not sure if it ever was as I cannot find a particular patch which fixes it.
But importantly the buffer test is there.

Note that many of the above "update released" messages are bogus.

https://build.suse.de/request/show/30353

mentions this bug number in the context of a completely different bug.
Comment 18 Marcus Meissner 2014-03-14 07:05:28 UTC 
thanks for checking!
Comment 21 Marcus Meissner 2014-06-17 16:22:00 UTC 
We backported the fix for CVE-2012-2375 differently, not removing the check that was the trigger for this issue.

So no SUSE Linux Enterprise Server version contained the incorrect fix / missing check.

So we were not affected by this problem.