diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-03-24 02:12:42 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2026-03-26 01:28:31 +0000 |
| commit | e5ed09ffd5927040a789b4333a856279181cef4a (patch) | |
| tree | 4f659b806a6e4409be3bc36e4056aa2eac54e23a /usr.bin/bluetooth | |
| parent | b45e7530ffb92fbaa24ad25c368479d4eb80dbf4 (diff) | |
rpcsec_gss: Fix a stack overflow in svc_rpc_gss_validate()stable/14
svc_rpc_gss_validate() copies the input message into a stack buffer
without ensuring that the buffer is large enough. Sure enough,
oa_length may be up to 400 bytes, much larger than the provided space.
This enables an unauthenticated user to trigger an overflow and obtain
remote code execution.
Add a runtime check which verifies that the copy won't overflow.
Approved by: so
Security: FreeBSD-SA-26:08.rpcsec_gss
Security: CVE-2026-4747
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: rmacklem
Fixes: a9148abd9da5d
(cherry picked from commit 143293c14f8de00c6d3de88cd23fc224e7014206)
Diffstat (limited to 'usr.bin/bluetooth')
0 files changed, 0 insertions, 0 deletions