REDHAT-BUG-2526794: Medium severity gvfs vulnerability
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service. This vulnerability affects all gvfs versions and is fixed in version 1.60.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gvfs (gvfsd-mtp / MTP backend)to a version that resolves this vulnerability.Fixed in 1.60.2 - Configuration
In gvfsbackendmtp.c, in do_read(), do not trust the MTP device-reported byte count; clamp/limit the length to the original size requested by the client before copying with memcpy(), to prevent reading/writing outside intended boundaries.
gvfsbackendmtp.c (do_read()) Length handling of MTP device returned data = Limit the returned length to the original client-requested size before passing it to memcpy()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use gvfs to access files on mounted MTP devices are exposed when an attacker can physically connect a malicious MTP device. The vulnerable path is reached when a file on that device is read.
What does an attacker need to do to exploit it?
An attacker needs to plug in a malicious MTP device and make it return more data than the client requested during a file read. Exploitation can crash the gvfsd-mtp process, causing denial of service.
Which versions are affected and which version contains the fix?
All gvfs versions are affected according to the advisory. The issue is fixed in gvfs version 1.60.2.