A flaw was found in the way the xfsda3fixhashpath() function of the Linux kernel's XFS file system implementation ordered directory hashes under certain conditions. A local attacker could use this flaw to corrupt the file system by creating directories, potentially resulting in kernel panic.

Upstream fix:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c88547a8119e3b581318ab65e9b72f27f23e641d

Reproducer:

http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs/cmds/xfstests.git;a=blob;f=src/dirhashcollide.c;h=55cec872d5061ac2ca0f56d1f11e6bf349d5bb97;hb=947ee8bd4b59770534297572b14c695e9c6e001e

References:

http://seclists.org/oss-sec/2014/q4/28 http://marc.info/?l=linux-xfs&m=139590613002926&w=2

A flaw was found in NFS in the Linux Kernel. An attacker who is able to mount an exported NFS filesystem is able to trigger a null pointer dereference by an invalid NFS sequence.

This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.

Upstream fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01310bb7c9c98752cc763b36532fab028e0f8f81