diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-03-24 02:12:42 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2026-03-26 01:30:00 +0000 |
| commit | 99ec7f9b9e4836733fbfeea272422a4d0d7adfd8 (patch) | |
| tree | ca80c3782fbc546db55cd912fadba2e16ee54187 /lib/libc/stdlib/cxa_thread_atexit.c | |
| parent | 536751cb4e159b7957e2b63ba44924b2f7f8e5cc (diff) | |
rpcsec_gss: Fix a stack overflow in svc_rpc_gss_validate()stable/13
svc_rpc_gss_validate() copies the input message into a stack buffer
without ensuring that the buffer is large enough. Sure enough,
oa_length may be up to 400 bytes, much larger than the provided space.
This enables an unauthenticated user to trigger an overflow and obtain
remote code execution.
Add a runtime check which verifies that the copy won't overflow.
Approved by: so
Security: FreeBSD-SA-26:08.rpcsec_gss
Security: CVE-2026-4747
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: rmacklem
Fixes: a9148abd9da5d
(cherry picked from commit 143293c14f8de00c6d3de88cd23fc224e7014206)
Diffstat (limited to 'lib/libc/stdlib/cxa_thread_atexit.c')
0 files changed, 0 insertions, 0 deletions