FreeBSD Errata Notice FreeBSD-EN-25:01.rpc
29 January, 2025 by errata-notices@freebsd.org | freebsd
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-25:01.rpc Errata Notice
The FreeBSD Project
Topic: NULL pointer dereference in the NFSv4 client
Category: core
Module: kernel
Announced: 2024-12-23
Affects: FreeBSD 14.1
Corrected: 2024-05-28 02:22:04 UTC (stable/14, 14.1-STABLE)
2025-01-29 18:55:17 UTC (releng/14.1, 14.1-RELEASE-p7)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The Network File System (NFS) allows a host to export some or all of its file
systems so that other hosts can access them over the network and mount them
as if they were on local disks. NFS is built on top of the Sun Remote
Procedure Call (RPC) framework. FreeBSD includes server and client
implementations of NFS.
NFS version 4 provides both client support and server support for delegation.
Delegation is a technique by which the server delegates the management of a
file to a client.
II. Problem Description
When a NFSv4.1/4.2 client callback related to delegations is handled, a
missing NULL pointer check can cause a kernel panic.
III. Impact
FreeBSD systems mounting a NFSv4 server with delegations enabled may cause a
kernel panic.
IV. Workaround
None, although NFSv4 clients mounting a server that has delegations disabled
are not affected.
If running a FreeBSD NFSv4 server, disabling delegations by setting the
sysctl vfs.nfsd.issue_delegations to 0 (which is the default) will prevent
any affected clients from crashing.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-25:01/rpc.patch
# fetch https://security.FreeBSD.org/patches/EN-25:01/rpc.patch.asc
# gpg --verify rpc.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 4c136aad80e6 stable/14-n269984
releng/14.1/ 4fdb8d1ab316 releng/14.1-n267728
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id(2156>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-25:01.rpc.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmeajKEACgkQbljekB8A
Gu+TKA/6AiM4K+rkbQVEIq7DP/Kodnl/HH03t3oMX+O6McIYnPPc0AtBflxjcGTK
JatRl4tFAkn/umXOLHw9ljqtIBz3Czj7i9mNvQ/z0j6oBZXnQLGXJdVcQLj5sZ2b
GbMFe8Pf6yhL+HZqRDK+AP0x8gx9fCRvK9N8rTnwNGk6JnJXGMhF0V7cYEsCvN29
xZX2VxxGo6APuFuct86FpDOZMnzqvGqukI2vTxwgG3kMDY4Y5DkVEwmjWOk4rAK9
+vGOrM+e+eUcktiIa+tFNmwhTexlXQ6LByiQKn6Py2jpcTJr2GP6AY/S4obHNGkB
prixFBP9H6CP6M27RlWGiKG+dr60tzKukWcvj+Y3Ogu9tQOY0p+RGfTY/v416aAP
VcFpxZhQc/67M45rRfPi8Ff+oXlcVXzmI1mkn4EcBcBC7DPLMD/Fvf0fixFKMLRw
tImHAIn0cKWyjfu/uXSspFo9GtuHEyfodeLhA52Fh7ulfWgjNoQDvFJE3KAD+GGo
x+GElJsO2Q+68b7b6sJPt0ZEijaDilI1d/cnwYYbXwwvnvbCPss7I9IWzB1T4xBI
dZM/ED7jPFt3cbH2btVAaHDyMsx3FW0RzjDbTMGZFbNFsF3Adbet2ds8Jym954K0
3MPv/T4OHui8tOL4WO3WMB/X50qDwBIFZC8+kU/MOe5OAq9yVyc=7P47
-----END PGP SIGNATURE-----