FKIE_CVE-2024-6759

Vulnerability from fkie_nvd - Published: 2024-08-12 13:38 - Updated: 2024-11-21 09:50
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir(3) and related functions to return filesystem entries with names containing additional path components. The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.
References
secteam@freebsd.orghttps://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.ascVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240816-0009/
Impacted products
Vendor Product Version
freebsd freebsd *
freebsd freebsd *
freebsd freebsd 13.3
freebsd freebsd 13.3
freebsd freebsd 13.3
freebsd freebsd 13.3
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.0
freebsd freebsd 14.1
freebsd freebsd 14.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18A4E85D-70A5-4382-AAB7-4A531615613D",
              "versionEndExcluding": "13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEC367A5-24D1-414E-BC77-07968E787D01",
              "versionEndExcluding": "13.3",
              "versionStartIncluding": "13.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
              "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
              "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
              "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
              "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
              "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
              "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
              "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
              "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
              "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
              "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
              "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
              "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
              "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
              "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
              "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory."
    },
    {
      "lang": "es",
      "value": "Al montar un sistema de archivos remoto usando NFS, el kernel no desinfect\u00f3 los nombres de archivos proporcionados de forma remota para el car\u00e1cter separador de ruta, \"/\". Esto permite que readdir(3) y funciones relacionadas devuelvan entradas del sistema de archivos con nombres que contienen componentes de ruta adicionales. La falta de validaci\u00f3n descrita anteriormente da lugar a un confuso problema de diputados. Por ejemplo, se podr\u00eda enga\u00f1ar a un programa que copia archivos desde un montaje NFS para que los copie desde fuera del directorio de origen previsto y/o a una ubicaci\u00f3n fuera del directorio de destino previsto."
    }
  ],
  "id": "CVE-2024-6759",
  "lastModified": "2024-11-21T09:50:15.657",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-08-12T13:38:40.380",
  "references": [
    {
      "source": "secteam@freebsd.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240816-0009/"
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.