diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-03-24 02:12:42 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2026-03-26 01:25:05 +0000 |
| commit | 1b00fdc1f3cd1311e4b52be253e0fecbca35941d (patch) | |
| tree | a883090a52de06dcafaf99e7bc0ef99045982de5 /lib/libc/csu/aarch64 | |
| parent | 1fddb5435315ca44c96960b16bdda8338afd15a1 (diff) | |
rpcsec_gss: Fix a stack overflow in svc_rpc_gss_validate()stable/15
svc_rpc_gss_validate() copies the input message into a stack buffer
without ensuring that the buffer is large enough. Sure enough,
oa_length may be up to 400 bytes, much larger than the provided space.
This enables an unauthenticated user to trigger an overflow and obtain
remote code execution.
Add a runtime check which verifies that the copy won't overflow.
Approved by: so
Security: FreeBSD-SA-26:08.rpcsec_gss
Security: CVE-2026-4747
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: rmacklem
Fixes: a9148abd9da5d
(cherry picked from commit 143293c14f8de00c6d3de88cd23fc224e7014206)
Diffstat (limited to 'lib/libc/csu/aarch64')
0 files changed, 0 insertions, 0 deletions