Описание
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.62.0-3 |
| esm-infra-legacy/xenial | released | 1.28.2-1ubuntu1~16.04.3+esm1 |
| esm-infra/bionic | released | 1.36.1-0ubuntu1.3.3+esm1 |
| esm-infra/focal | released | 1.44.1-1ubuntu1.2+esm1 |
| jammy | released | 1.48.2-0ubuntu1.2 |
| noble | released | 1.54.4-0ubuntu1~24.04.4 |
| resolute | released | 1.60.0-1ubuntu0.1 |
| stonking | not-affected | 1.62.0-3 |
| upstream | released | 1.60.2-1 |
Показывать по
EPSS
8.8 High
CVSS3
Связанные уязвимости
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
A flaw was found in the SFTP backend in gvfs. When mounting a share an ...
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
EPSS
8.8 High
CVSS3