| Summary: | Kernel : libceph NULL function pointer dereference | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Kernel | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | normal | CC: | kernel |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
err, dupe of 475618 *** This bug has been marked as a duplicate of bug 475618 *** |
From ${URL} : Chanam Park discovered that a crafted auth_reply message could cause a NULL function pointer dereference in the libceph auth_none handler. A remote attacker could use this flaw to cause a denial of service. If a malicious Ceph monitor sends an auth_reply message with the value of -EAGAIN in the result field, ceph_build_auth_request() will call the ceph_auth_client_ops->build_request() function pointer without checking to see if the build_request() pointer is NULL. The auth_none handler does not initialize its build_request() pointer. See http://hkpco.kr/advisory/CVE-2013-1059.txt for more information. The fix can be found in the upstream ceph-client.git tree: https://git.kernel.org/cgit/linux/kernel/git/sage/ceph-client.git/commit/?id=2cb33cac622afde897aa02d3dcd9fbba8bae839e