CVE-2013-4591: Buffer Overflow
Buffer overflow in the nfs4getacluncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4acl extended attribute of a pathname on an NFSv4 filesystem.
Other sources
Commit 1f1ea6c (included in Red Hat Enterprise Linux 6 as part of CVE-2012-2375 fix) accidently dropped the checking for too small result buffer length. If someone uses getxattr on "system.nfs4acl" on an NFSv4 mount supporting ACLs, the ACL has not been cached and the buffer suplied is too short, we still copy the complete ACL, resulting in kernel and user space memory corruption.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f1ea6c2d9d8c0be9ec56454b05315273b5de8ce
Upstream commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7d3e91a89b7adbc2831334def9e494dd9892f9af
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4591?
CVE-2013-4591 has a high severity rating due to the potential for local users to cause denial of service through memory corruption.
How do I fix CVE-2013-4591?
To fix CVE-2013-4591, upgrade to Linux kernel version 3.7.2 or later.
What type of vulnerability is CVE-2013-4591?
CVE-2013-4591 is a buffer overflow vulnerability in the Linux kernel affecting specific extended attributes.
Which versions of Linux kernel are affected by CVE-2013-4591?
CVE-2013-4591 affects all Linux kernel versions prior to 3.7.2.
What is the impact of CVE-2013-4591?
The impact of CVE-2013-4591 includes potential system crashes and undefined behavior due to memory corruption.