diff options
| author | Mariusz Zaborski <oshogbo@FreeBSD.org> | 2026-04-28 14:36:09 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-04-29 14:40:57 +0000 |
| commit | 414e25d7d5128e5d0275f18a6633a11d36fafc8c (patch) | |
| tree | 86ee4d6c6f1ef31e32eeecf2cdced5fb22225208 /libexec/fingerd | |
| parent | 025789eaa648bdb3f3400f3d6412947cc151ebd8 (diff) | |
libnv: fix heap overflow in nvlist_recv()
nvlist_check_header() validated nvlh_size for overflow before
performing conversion. An mallicous user can set
NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that
the orginall value passes the check, but after the conversion the
sizeof(nvlist_header) + size can overflow.
This can lead to a heap buffer overflow.
Approved by: so
Security: FreeBSD-SA-26:17.libnv
Security: CVE-2026-35547
Fixes: 36fa90dbde0060aacb5677d0b113ee168e839071
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56342
Diffstat (limited to 'libexec/fingerd')
0 files changed, 0 insertions, 0 deletions