Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svc_encode_getaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and d_really_is_positive(dentry), but that looks like overkill to me--zero status should be enough to guarantee a positive dentry. This isn't the first time we've seen an error-case NULL dereference hidden in the initialization of a local variable in an xdr encoder. But I went back through the other recent rewrites and didn't spot any similar bugs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d505e66191072748620fc0af038cea4e4da0e3cd to < e79057d15d96ef19de4de6d7e479bae3d58a2a8daffected20798dfe249a01ad1b12eec7dbc572db5003244a to < 650e6f383a6eb40f7c0a010982a74ab4b6893870affected20798dfe249a01ad1b12eec7dbc572db5003244a to < ab1016d39cc052064e32f25ad18ef8767a0ee3b8affected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected5.13.4 to ≤ 5.13.*unaffected5.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d ↗
- https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870 ↗
- https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html ↗