CVE-2012-2375: Medium severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
The nfs4getacluncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4ACL reply. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.
— MITRE
The fix for CVE-2011-4131 was not complete. Malicious NFS server could still crash the clients when returns more than 2 GETATTR bitmap words in response to the FATTR4ACL attribute request.
Upstream fixes: 20e0fa98b751facf9a1101edaefbc19c82616a68 5794d21ef4639f0e33440927bb903f9598c21e92 5a00689930ab975fdd1b37b034475017e460cf2a
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2375?
CVE-2012-2375 has a severity that can lead to a denial of service condition due to an incorrect length variable used in a copy operation.
How do I fix CVE-2012-2375?
To fix CVE-2012-2375, update the Linux kernel to version 3.3.2 or later.
What software is affected by CVE-2012-2375?
CVE-2012-2375 affects the Linux kernel versions prior to 3.3.2, including various 3.3 release candidates.
What type of vulnerability is CVE-2012-2375?
CVE-2012-2375 is a vulnerability that allows remote NFS servers to potentially cause a denial of service.
Can CVE-2012-2375 be exploited remotely?
Yes, CVE-2012-2375 can be exploited remotely by sending crafted requests to an NFSv4 server.