CVE-2010-0727: Medium severity Linux Linux kernel vulnerability
Reported internally.
static int gfslock(struct file file, int cmd, struct filelock fl) { .. if ((ip->idi.dimode & (SISGID | SIXGRP)) == SISGID) return -ENOLCK; .. }
This is a check for mandatory locking where the GFS locking code will skip the lock in case sgid bits are set for the file.
This is similar to bz 218777 which affected RHEL 4 NFS shares on the client. The reproducer from https://bugzilla.redhat.com/showbug.cgi?id=218777#c1 (private) can be used to crash a system mounting a GFS filesystem.
I was able to reproduce this on 2.6.18-164.11.1 with kmod-gfs-0.1.34-2.el5
----------- [cut here ] --------- [please bite here ] --------- Kernel BUG at fs/locks.c:2080 invalid opcode: 0000 [1] SMP last sysfs file: /kernel/dlm/gfs-sachin/id CPU 0 Modules linked in: gfs(U) lockdlm gfs2 dlm configfs netloop netbk blktap blkbk iptMASQUERADE iptablenat ipnat xtstate ipconntrack nfnetlink iptREJECT xttcpudp iptablefilter iptables xtables bridge autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc iscsitcp bnx2i cnic uio cxgb3i cxgb3 8021q libiscsitcp ibiser libiscsi2 scsitransportiscsi2 scsitransportiscsi ibsrp rds ibsdp ibipoib ipoibhelper ipv6 xfrmnalgo cryptoapi rdmaucm rdmacm ibucm ibuverbs ibumad ibcm iwcm ibaddr ibsa ibmad ibcore loop dmemc dmroundrobin dmmultipath scsidh video hwmon backlight sbs i2cec i2ccore button battery asusacpi ac parportpc lp parport srmod sg joydev pcspkr i5000edac edacmc qla2xxx bnx2 atapiix libata scsitransportfc serialcore serioraw idecd cdrom dmraid45 dmmessage dmregionhash dmmemcache dmsnapshot dmzero dmmirror dmlog dmmod usbstorage shpchp mptsas mptscsih mptbase scsitransportsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihc
Pid: 12585, comm: crash Tainted: G 2.6.18-164.11.1.HOTFIX.el5xen #1 RIP: e030:[<ffffffff80227976>] [<ffffffff80227976>] locksremoveflock+0xe4/0x124 RSP: e02b:ffff88003ff5de28 EFLAGS: 00010246 RAX: ffff88005275b3f8 RBX: ffff88003fb405b0 RCX: 7fffffffffffffff RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffffffff8052d800 RBP: ffff8800512d23c0 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88003ff5de28 R11: 00000000000000b0 R12: ffff88003fb404b0 R13: ffff88003fb404b0 R14: ffff8800545af0c0 R15: ffff88003fed64b0 FS: 00002b71ceb65210(0000) GS:ffffffff805ca000(0000) knlGS:0000000000000000 CS: e033 DS: 0000 ES: 0000 Process crash (pid: 12585, threadinfo ffff88003ff5c000, task ffff880060288040) Stack: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000003129 0000000000000000 0000000000000000 0000000000000000 Call Trace: [<ffffffff802132d8>] fput+0x94/0x198 [<ffffffff802240af>] filpclose+0x5c/0x64 [<ffffffff8021e2c7>] sysclose+0x88/0xbd [<ffffffff802602f9>] tracesys+0xab/0xb6
Other sources
The gfs2lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfslock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-0727?
CVE-2010-0727 is considered to have a moderate severity due to potential issues with mandatory file locking.
How do I fix CVE-2010-0727?
To mitigate CVE-2010-0727, upgrade affected packages to the versions specified in the remediation section of the vulnerability report.
What versions of the gfs-kmod package are affected by CVE-2010-0727?
The gfs-kmod package versions prior to 0:0.1.34-12.el5 and 0:0.1.34-2.el5_4.3 are affected by CVE-2010-0727.
Which kernel versions are impacted by CVE-2010-0727?
Kernel versions up to 0:2.6.18-194.el5 and 0:2.6.18-164.17.1.el5 are impacted by CVE-2010-0727.
What is the nature of the vulnerability in CVE-2010-0727?
CVE-2010-0727 involves issues in the GFS locking mechanism regarding mandatory locks that could result in file access conflicts.