ReiserFS 3.5.28 (Linux Kernel) - Code Execution / Denial of Service

Author: Marc Lehmann
type: dos
platform: linux
port: 
date_added: 2001-01-09 
date_updated: 2016-09-04 
verified: 1 
codes: CVE-2001-0172;OSVDB-13800 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/2180/info

ReiserFS is a file system alternative to the Linux ext2 file system. It was originally written by Hans Reiser, and is freely available and publicly maintained.

A problem has been reported in the handling of long file names with ReiserFS version 3.5.28 on SuSE Linux distribution 7.0. It is possible to create a directory with a long file name (the initial example displayed a directory with 768 characters), then attempt to list the file system using system binary ls or with built in shell function echo and create a Denial of Service. Upon attempting to list or echo the contents of the filesystem, a kernel buffer overflow occurs, overwriting variables on the stack including possibly the return address, as well as crashing the system. It may be possible for a malicious user to execute arbitrary code, deny service to legitimate users, and potentially break out of a chroot environment. This vulnerability is yet unverified.

mkdir "$(perl -e 'print "x" x 768')"