CVE-2009-3726
Linux Kernel < 2.6.31 - Denial of Service via NFSv4 Server Response with Incorrect File Attributes
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-3726. PoCs published by Simon Vallet.
AI-analyzed exploit summary This PoC exploits a NULL-pointer dereference in the Linux kernel's NFSv4 implementation (nfs4_proc_lock) by executing a specific file lock operation, leading to a kernel panic (DoS). The exploit triggers the vulnerability by calling fcntl with F_SETLK on /proc/self/exe.
Description
The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
Exploits (1)
This PoC exploits a NULL-pointer dereference in the Linux kernel's NFSv4 implementation (nfs4_proc_lock) by executing a specific file lock operation, leading to a kernel panic (DoS). The exploit triggers the vulnerability by calling fcntl with F_SETLK on /proc/self/exe.