Bug 254903 (CVE-2008-4307)

Summary:	Kernel: Race condition in do_setlk() in fs/nfs/file.c (CVE-2008-4307)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git;a=commit;h=c4d7c402b788b73dc24f1e54a57f89d3dc5eb7bc
Whiteboard:	[linux <2.6.26]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2009-01-13 23:39:58 UTC

CVE-2008-4307 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4307):
  Race condition in the do_setlk function in fs/nfs/file.c in the Linux
  kernel before 2.6.26 allows local users to cause a denial of service
  (crash) via vectors resulting in an interrupted RPC call that leads
  to a stray FL_POSIX lock, related to improper handling of a race
  between fcntl and close in the EINTR case.