CVE Request: OpenAFS: directory information leaks (OPENAFS-SA-2016-003)

[Salvatore Bonaccorso <carnil () debian org>]

Hi

The OpenAFS project has released a security advisory:

https://www.openafs.org/pages/security/OPENAFS-SA-2016-003.txt

OpenAFS Security Advisory 2016-003

> Topic: directory information leakage
>                                                                                                   
> Issued: 30 November, 2016
> Affected: OpenAFS client versions 1.0 through 1.6.19
>           OpenAFS servers versions 1.0 through 1.6.19
>
> The contents of OpenAFS directories may be leaked in client cache partitions,
> in fileserver vice partitions, and on the wire for certain RPCs.
>
> SUMMARY
> =======
>
> Due to incomplete initialization or clearing of reused memory, OpenAFS
> directory objects are likely to contain "dead" directory entry information.
> This extraneous information is not active - that is, it is logically invisible
> to the fileserver and client. However, the leaked information is physically
> visible on the fileserver vice partition, on the wire in FetchData replies and
> other RPCs, and on the client cache partition. This constitutes a leak of
> directory information.

I'm attaching the full advisory for reference (and to have it int the
list archives).

Patches:

https://www.openafs.org/pages/security/openafs-sa-2016-003.patch
https://www.openafs.org/pages/security/openafs-sa-2016-003-master.patch

Could you please assign a CVE for the directory information leak issue
in OpenAFS?

Regards,
Salvatore

Attachment: OPENAFS-SA-2016-003.txt
Description: