Note: This is an archival copy of Security Sun Alert 248566 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019903.1.
Solaris 10 Operating System
Date of Resolved Release
A Security Vulnerability in the NFS Version 4 Client Within Solaris May Lead to a System Panic
A security vulnerability in the NFS version 4 client within Solaris may allow a local unprivileged user to panic the system. This is a type of Denial of Service (DoS).
2. Contributing Factors
This issue can occur in the following releases:
1. Solaris 8 and 9 are not impacted by this issue.
2. OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. The base build can be derived as follows:
$ uname -v3. Systems are only impacted by this vulnerability if they are using NFS version 4 (NFSv4) to access remote filesystems. To determine if a system is using NFSv4, the following nfsstat(1M) command can be used:
$ nfsstat -mThe "vers=4" value in the above Flags output indicates use of NFSv4.
Note that systems not using NFSv4 mount points may do so in the future, and all systems should be secured against this threat.
Should the described issue occur, the system will panic with a stack trace similar to the following:
vpanic(....)Most of the panics due to this issue show this trace and 1st and 2nd argument to fn_move() will be the same.
To work around this issue, use NFSv3 on the NFS client by setting NFS_CLIENT_VERSMAX to 3 in /etc/default/nfs, and remounting the existing NFSv4 filesystems.
An example of the entry in /etc/default/nfs:
NFS_CLIENT_VERSMAX=3To locate which NFSv4 mountpoints qualify for unmounting, the nfsstat(1M) command can be run, as in the following example:
# nfsstat -mThe vers=4 value in the above output indicates a NFsv4 filesystem.
To unmount the NFSv4 mountpoint, the following command can be used:
# umount /mntNote: If the umount command shown above does not succeed, the filesystem may be busy and a forced unmount may be necessary. A list of processes using the filesystem can be determined with the fuser(1M) command:
# fuser -c <mountpoint>These processes should be terminated prior to retrying the umount command.
Alternatively, the mountpoint can be forcibly unmounted. Note that this may result in application errors and/or potential data inconsistency, so this should be used with caution.
To forcibly unmount the NFSv4 mountpoint:
# umount -f <mountpoint>To remount the filesystem:
# mount -Fnfs testhost:/space/data /mntTo confirm that the filesystem has been properly remounted as a NFSv3 filesystem, use nfsstat(1M) and confirm that vers=3:
# nfsstat -m
This issue is addressed in the following releases:
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment