diff options
| author | Rick Macklem <rmacklem@FreeBSD.org> | 2024-07-21 22:56:16 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2024-08-07 13:25:36 +0000 |
| commit | 4e7bf17e9db892ab47ede6c12aa0d2902c5ff795 (patch) | |
| tree | 721437cde85f3052ca2de0a9283104640200fd58 /lib/libdevctl/devctl.c | |
| parent | 5e23806790ef4825ac09b458d3df941748599fbb (diff) | |
nfscl: Scan readdir reply filenames for invalid characters
The NFS RFCs are pretty loose with respect to what characters
can be in a filename returned by a Readdir. However, FreeBSD,
as a POSIX system will not handle imbedded '/' or nul characters
in file names. Also, for NFSv4, the file names "." and ".."
are handcrafted on the client and should not be returned by a
NFSv4 server.
This patch scans for the above in filenames returned by Readdir and
ignores any entry returned by Readdir which has them in it.
Because an imbedded nul would be a string terminator, it was
not possible to code this check efficiently using string(3)
functions.
Approved by: so
Security: FreeBSD-SA-24:07.nfsclient
Security: CVE-2024-6759
Reported by: Apple Security Engineering and Architecture (SEAR)
(cherry picked from commit 026cdaa3b3a92574d9ac3155216e5cc0b0bd4c51)
(cherry picked from commit 9328ded386d570c8455b9021e047520ef72e0e79)
Diffstat (limited to 'lib/libdevctl/devctl.c')
0 files changed, 0 insertions, 0 deletions