Bug 234803 (CVE-2008-3275)

Summary:	Kernel: fix lookup on deleted directory (CVE-2008-3275)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d70b67c8bc72ee23b55381bd6a884f4796692f77
Whiteboard:	[linux <2.6.25.15] [linux >=2.6.26 <2.6.26.2]
Package list:		Runtime testing required:	---

Description Robert Buchholz (RETIRED) gentoo-dev

2008-08-15 10:56:24 UTC

CVE-2008-3275 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3275):
  The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs
  implementation in the Linux kernel before 2.6.25.15 does not prevent creation
  of a child dentry for a deleted (aka S_DEAD) directory, which allows local
  users to cause a denial of service ("overflow" of the UBIFS orphan area) via
  a series of attempted file creations within deleted directories.

Comment 1 Robert Buchholz (RETIRED) gentoo-dev

2008-08-15 10:57:53 UTC

Also fixed in 2.6.25.15 and 2.6.26.2

Comment 2 kfm 2009-07-20 19:26:23 UTC

hardened-kernel unaffected at present time. Removing alias.

PS: genpatches-2.6.25-10 included the 2.6.25.15 patch and genpatches-2.6.26-2
included the 2.6.26.2 patch