REDHAT-BUG-2526485: High severity Gnome gvfs vulnerability
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution. This vulnerability affects all gvfs versions and is fixed in version 1.60.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gvfsto a version that resolves this vulnerability.Fixed in 1.60.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using gvfs to mount and read from an SFTP share are exposed if the SFTP server is malicious. The affected component is the gvfsd-sftp process.
What does an attacker need to exploit it?
An attacker needs to operate or control an SFTP server that a client mounts and reads a file from. The malicious server must return a read reply with a length larger than the client requested.
Are all gvfs versions affected, and what version contains the fix?
All gvfs versions are affected according to the advisory. The issue is fixed in gvfs version 1.60.2.
What is the likely impact of successful exploitation?
A malicious server can corrupt adjacent heap memory in gvfsd-sftp. This can cause a denial of service when heap corruption is detected, and may potentially allow arbitrary code execution.