CVE-2012-1090

Published: 28 February 2012

The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO. "The cifs code will attempt to open files on lookup under certain circumstances. What happens though if we find that the file we opened was actually a FIFO or other special file? Currently, the open filehandle just ends up being leaked leading to a dentry refcount mismatch and oops on umount."

From the Ubuntu Security Team

A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service.

Notes

currently sitting in the master branch of the tree below, waiting
on merge with linus:
git://git.samba.org/sfrench/cifs-2.6
see:
cifs: fix dentry refcount leak when opening a FIFO on lookup
now upstream (see below)

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1090
• http://thread.gmane.org/gmane.linux.kernel.cifs/5526
• http://www.openwall.com/lists/oss-security/2012/02/28/3
• https://ubuntu.com/security/notices/USN-1405-1
• https://ubuntu.com/security/notices/USN-1425-1
• https://ubuntu.com/security/notices/USN-1426-1
• https://ubuntu.com/security/notices/USN-1431-1
• https://ubuntu.com/security/notices/USN-1433-1
• https://ubuntu.com/security/notices/USN-1432-1
• https://ubuntu.com/security/notices/USN-1440-1
• https://ubuntu.com/security/notices/USN-1446-1
• https://ubuntu.com/security/notices/USN-1458-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=798293
• https://launchpad.net/bugs/947997