HomeFreeBSD

nfscl: Scan readdir reply filenames for invalid characters

Description

nfscl: Scan readdir reply filenames for invalid characters

The NFS RFCs are pretty loose with respect to what characters
can be in a filename returned by a Readdir. However, FreeBSD,
as a POSIX system will not handle imbedded '/' or nul characters
in file names. Also, for NFSv4, the file names "." and ".."
are handcrafted on the client and should not be returned by a
NFSv4 server.

This patch scans for the above in filenames returned by Readdir and
ignores any entry returned by Readdir which has them in it.
Because an imbedded nul would be a string terminator, it was
not possible to code this check efficiently using string(3)
functions.

Approved by: so
Security: FreeBSD-SA-24:07.nfsclient
Security: CVE-2024-6759
Reported by: Apple Security Engineering and Architecture (SEAR)

(cherry picked from commit 026cdaa3b3a92574d9ac3155216e5cc0b0bd4c51)
(cherry picked from commit 9328ded386d570c8455b9021e047520ef72e0e79)

Details

Provenance
rmacklemAuthored on Jul 21 2024, 10:56 PM
markjCommitted on Aug 7 2024, 1:25 PM
Parents
rG5e23806790ef: Add UPDATING entries and bump the branch version.
Branches
Unknown
Tags
Unknown