CVE-2011-1749: Input Validation

It was found that mount.nfs suffers from the same flaw as other mount helpers (see CVE-2011-1089). Instead of using addmntent(), nfs-utils implements its own similar function (nfsaddmntent()) which also fails to anticipate whether resource limits would interfere with correctly writing to /etc/mtab. A local user could use this to trigger corruption of the /etc/mtab file via a process with a small RLIMITFSIZE value.

In nfs-utils-1.2.3/support/nfs/nfsmntent.c:

126 int 127 nfsaddmntent (mntFILE mfp, struct mntent mnt) { 128 char m1, m2, m3, m4; 129 int res; 130 131 if (fseek (mfp->mntentfp, 0, SEEKEND)) 132 return 1; / failure / 133 134 m1 = mangle(mnt->mntfsname); 135 m2 = mangle(mnt->mntdir); 136 m3 = mangle(mnt->mnttype); 137 m4 = mangle(mnt->mntopts); 138 139 res = fprintf (mfp->mntentfp, "%s %s %s %s %d %d\n", 140 m1, m2, m3, m4, mnt->mntfreq, mnt->mntpassno); 141 142 free(m1); 143 free(m2); 144 free(m3); 145 free(m4); 146 return (res < 0) ? 1 : 0; 147 }

The above function should use fflush() and return failure based on the success of the fflush() call, to ensure it is fully written prior to updating /etc/mtab. Perhaps something like:

146 return (res < 0) ? 1 : ((fflush(mfp->mntentfp) == 0) ? 0 : 1);