James McKenzie has reported a vulnerability in Linux Kernel, which can be exploited by malicious users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in ext3 when handling an invalid inode number. This can be exploited by sending a specially crafted NFS request with a V2 procedure (e.g. V2_LOOKUP) that specifies an invalid inode number.

Successful exploitation causes the exported directory to be remounted read-only.

The vulnerability has been reported in versions 2.6.14.4, 2.6.17.6, and 2.6.17.7. Other versions may also be affected.

Solution
A patch is committed to the GIT repository.

Provided and/or discovered by
James McKenzie

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://lkml.org/lkml/2006/7/17/41
http://git.parisc-linux.org/?p=linux-2.6.git;a=commit;h=2ccb48ebb4de139eef4fcefd5f2bb823cb0d81b9

Deep Links
Links available to Secunia VIM customers