[Midnightbsd-cvs] [MidnightBSD/src] 6ddcd2: Remote code execution via RPCSEC_GSS packet valida...

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 6ddcd2b5d1383b15797b66c06becda71aa98d7b6
      https://github.com/MidnightBSD/src/commit/6ddcd2b5d1383b15797b66c06becda71aa98d7b6
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-03-26 (Thu, 26 Mar 2026)

  Changed paths:
    M lib/librpcsec_gss/svc_rpcsec_gss.c
    M sys/rpc/rpcsec_gss/svc_rpcsec_gss.c

  Log Message:
  -----------
  Remote code execution via RPCSEC_GSS packet validation

Each RPCSEC_GSS data packet is validated by a routine which checks a signature
in the packet.  This routine copies a portion of the packet into a stack buffer,
but fails to ensure that the buffer is sufficiently large, and a malicious
client can trigger a stack overflow.  Notably, this does not require the client
to authenticate itself first.

Obtained from: FreeBSD



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications