CVE-2011-0714

Vulnerability

A use-after-free vulnerability exists in the RPC server sockets implementation of the Linux kernel, specifically in the svc_xprt_received function, related to the lockd service. The flaw affects the kernel version 2.6.32 as shipped with Red Hat Enterprise Linux 6 due to an incomplete backport of upstream commit b48fa6b9 [4]. A remote attacker can trigger the use-after-free by sending a malformed data packet to the target system [1][2][3].

Exploitation

An attacker requires network access to the target system and no authentication is needed. The attacker sends a specially crafted, corrupted packet to the RPC server. The packet is processed by the lockd service, which calls svc_xprt_received on a socket that has already been freed, leading to a use-after-free condition [1][2][3].

Impact

Successful exploitation results in a denial of service (DoS) by causing a kernel crash. No data compromise or privilege escalation is reported; the impact is limited to system availability [1][2][3].

Mitigation

Red Hat released updated kernel packages as part of RHSA-2011-0329 to fix this issue [1]. Users should apply the update and reboot the system. No workarounds are available. This vulnerability only affects Red Hat Enterprise Linux 6; RHEL 4, 5, and Red Hat Enterprise MRG are not affected [4].