CVE-2008-4307: Race Condition
Published Jul 22, 2008
·Updated
Race condition in the dosetlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FLPOSIX lock, related to improper handling of a race between fcntl and close in the EINTR case.
Affected Software
102 affected components
Linux Linux kernel=2.6.25.4
Linux Linux kernel=2.6.25.11
Linux Linux kernel=2.6.18-rc3
Linux Linux kernel=2.6.25.9
Linux Linux kernel=2.6.22.15
Linux Linux kernel=2.6.24.7
Linux Linux kernel=2.6.18-rc2
Linux Linux kernel=2.6.23.13
Linux Linux kernel=2.6.24.2
Linux Linux kernel=2.4.36.6
Linux Linux kernel=2.6.18-rc5
Linux Linux kernel=2.6.18-rc4
Linux Linux kernel=2.6.22.21
Linux Linux kernel=2.6.25.12
Linux Linux kernel=2.6.25.5
Linux Linux kernel=2.6.23.8
Linux Linux kernel=2.6.25
Linux Linux kernel=2.6.22.12
Linux Linux kernel=2.6.25.8
Linux Linux kernel=2.6.21.6
Linux Linux kernel=2.4.36.2
Linux Linux kernel=2.6.22.1
Linux Linux kernel=2.6.23.16
Linux Linux kernel=2.6.24.1
Linux Linux kernel=2.6.25.6
Linux Linux kernel=2.6.22
Linux Linux kernel=2.6.20.16
Linux Linux kernel=2.6.19.4
Linux Linux kernel=2.6.25.13
Linux Linux kernel=2.6.20.21
Linux Linux kernel=2.6.25.7
Linux Linux kernel=2.4.36.1
Linux Linux kernel=2.6.25.3
Linux Linux kernel=2.6.24
Linux Linux kernel=2.6.20.17
Linux Linux kernel=2.6.21.5
Linux Linux kernel=2.6.25.15
Linux Linux kernel=2.6.24_rc4
Linux Linux kernel=2.6.23.15
Linux Linux kernel=2.6.23.10
Linux Linux kernel=2.4.36.4
Linux Linux kernel=2.6.20.20
Linux Linux kernel=2.6.22.18
Linux Linux kernel=2.6.25.8
Linux Linux kernel=2.4.36.3
Linux Linux kernel=2.6.22.20
Linux Linux kernel=2.6.20.18
Linux Linux kernel=2.6.23.9
Linux Linux kernel=2.6.25.2
Linux Linux kernel=2.6.25.1
Linux Linux kernel=2.6.24.4
Linux Linux kernel=2.6.25.16
Linux Linux kernel=2.6.22.9
Linux Linux kernel=2.6.25.17
Linux Linux kernel=2.6.22.13
Linux Linux kernel=2.6.19.7
Linux Linux kernel=2.6.24.5
Linux Linux kernel=2.6.24_rc1
Linux Linux kernel=2.6.20.19
Linux Linux kernel=2.6.22.17
Linux Linux kernel=2.6.25.10
Linux Linux kernel=2.6.22.11
Linux Linux kernel=2.6.23
Linux Linux kernel=2.6.22.10
Linux Linux kernel=2.6.23.17
Linux Linux kernel=2.6.25.1
Linux Linux kernel=2.6.25.4
Linux Linux kernel=2.6.25.3
Linux Linux kernel=2.6.21.7
Linux Linux kernel=2.6.23_rc1
Linux Linux kernel=2.6.22.22
Linux Linux kernel=2.6.18-rc7
Linux Linux kernel=2.6.25.5
Linux Linux kernel=2.6.24.6
Linux Linux kernel=2.6.22_rc7
Linux Linux kernel=2.4.36
Linux Linux kernel=2.6.23.12
Linux Linux kernel=2.6.24_rc5
Linux Linux kernel=2.6.19.6
Linux Linux kernel=2.6.25.11
Linux Linux kernel=2.6.18-rc6
Linux Linux kernel=2.6.22.8
Linux Linux kernel=2.6.19.5
Linux Linux kernel=2.6.18
Linux Linux kernel=2.4.36.5
Linux Linux kernel=2.6.22.2
Linux Linux kernel=2.2.27
Linux Linux kernel=2.6.22.19
Linux Linux kernel=2.6.24.3
Linux Linux kernel=2.6.22_rc1
Linux Linux kernel=2.6.25
Linux Linux kernel=2.6.25.2
Linux Linux kernel=2.6.25.7
Linux Linux kernel=2.6.25.14
Linux Linux kernel=2.6.25.12
Linux Linux kernel=2.6.25.6
Linux Linux kernel=2.6.18-rc1
Linux Linux kernel=2.6.23.11
Linux Linux kernel=2.6.22.14
Linux Linux kernel=2.6.25.10
Linux Linux kernel=2.6
Linux Linux kernel<=2.6.25.9
Event History
Jul 22, 2008
Data Sourced
04:32 PM
DescriptionSeverityAffected Software
Jan 13, 2009
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-4307?
CVE-2008-4307 is classified as a medium-severity vulnerability that can cause denial of service.
2
How do I fix CVE-2008-4307?
To fix CVE-2008-4307, upgrade the Linux kernel to version 2.6.26 or later.
3
What operating system versions are affected by CVE-2008-4307?
CVE-2008-4307 affects various versions of the Linux kernel prior to 2.6.26.
4
What type of vulnerability is CVE-2008-4307?
CVE-2008-4307 is a race condition vulnerability located in the do_setlk function of the Linux kernel.
5
What impact does CVE-2008-4307 have on Linux systems?
The vulnerability can lead to a system crash due to improper handling of RPC calls.