NetSight
IP …
high7.8

CVE-2009-3623

The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even wh…

Impact

The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an NFSv4 mount request.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
through 2.6.31.1
Versions 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4

Weakness classification

CWE-287

References