OpenAFS: Denial of service

Background

OpenAFS is a distributed network filesystem.

Description

Russ Allbery, Jeffrey Altman, Dan Hyde and Thomas Mueller discovered a race condition due to an improper handling of the clients callbacks lists.

Impact

A remote attacker could construct cases which trigger the race condition, resulting in a server crash.

Workaround

There is no known workaround at this time.

Resolution

All OpenAFS users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-fs/openafs-1.4.6"