CVE-2010-0727

Vulnerability

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in Red Hat Enterprise Linux (RHEL) 5 and 6, improperly handles POSIX locks on files that have the setgid bit set without group-execute permission. When a file's mode has S_ISGID set but S_IXGRP not set, the code returns -ENOLCK to indicate mandatory locking is not supported, but fails to remove any existing POSIX lock on the file [1]. This leads to a kernel BUG at fs/locks.c:2080 when the lock is later processed [1].

Exploitation

An attacker must have local access to a system mounting a GFS or GFS2 filesystem. The attacker first acquires a POSIX lock on a file (e.g., using flock or fcntl). Then, the attacker changes the file's permissions to set the setgid bit without group-execute permission (e.g., chmod g+s,g-x file). This triggers the flawed code path, causing a kernel BUG and system crash [1].

Impact

Successful exploitation results in a denial of service (system crash) due to a kernel BUG. The crash is local and does not require elevated privileges beyond the ability to lock files and change permissions on the filesystem.

Mitigation

Red Hat released updates via RHSA-2010-0330, RHSA-2010-0521, and RHSA-2010-0380 for RHEL 5 and 6 [2][3][4]. The upstream fix is included in Linux kernel version 2.6.34-rc1-next-20100312. Users should apply the appropriate kernel update from their vendor.