FreeBSD Security Advisory FreeBSD-SA-24:16.libnv
19 September, 2024 by security-advisories@freebsd.org | freebsd
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:16.libnv Security Advisory
The FreeBSD Project
Topic: Integer overflow in libnv
Category: core
Module: libnv
Announced: 2024-09-19
Credits: Miłosz Kaniewski
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-15 16:59:15 UTC (stable/14, 14.1-STABLE)
2024-09-19 13:30:20 UTC (releng/14.1, 14.1-RELEASE-p5)
2024-09-19 13:30:45 UTC (releng/14.0, 14.0-RELEASE-p11)
2024-09-15 16:59:51 UTC (stable/13, 13.4-STABLE)
2024-09-19 13:35:07 UTC (releng/13.4, 13.4-RELEASE-p1)
2024-09-19 13:35:38 UTC (releng/13.3, 13.3-RELEASE-p7)
CVE Name: CVE-2024-45287
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
libnv (also called nvlist) is a general-purpose library designed for storing
name-value pairs. This library can serve as an Inter-Process Communication
(IPC) framework, enabling processes to exchange data. For example, it is
used in libcasper to communicate between privileged and unprivileged
processes. Additionally, libnv can function as an interface for communication
between userland and kernel.
Originally, libnv was inspired by OpenZFS nvlist. However, the
implementations are separate. This advisory is only about base system
implementation of libnv, not a OpenZFS one.
II. Problem Description
A malicious value of size in a structure of packed libnv can cause an integer
overflow, leading to the allocation of a smaller buffer than required for the
parsed data. The introduced check was incorrect, as it took into account the
size of the pointer, not the structure. This vulnerability affects both
kernel and userland.
This issue was originally intended to be addressed as part of
FreeBSD-SA-24:09.libnv, but due to a logic issue, this issue was not properly
addressed.
III. Impact
It is possible for an attacker to overwrite portions of memory (in userland
or the kernel) as the allocated buffer might be smaller than the data
received from a malicious process. This vulnerability could result in
privilege escalation or cause a system panic.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:16/libnv.patch
# fetch https://security.FreeBSD.org/patches/SA-24:16/libnv.patch.asc
# gpg --verify libnv.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
d) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 056c50c48be3 stable/14-n268739
releng/14.1/ f67468e6e5e2 releng/14.1-n267717
releng/14.0/ e9d57be06e23 releng/14.0-n265454
stable/13/ d84fced6b468 stable/13-n258342
releng/13.4/ 2cffa6354d9f releng/13.4-n258259
releng/13.3/ 417e81a40091 releng/13.3-n257469
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45287>
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:09.libnv.asc>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:16.libnv.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbsPQ8ACgkQbljekB8A
Gu9aMBAA1N3FliBdeklIU0XGoyrvS0z7goFpFKeLVlkIHssYzZQAWHMILHET6O9n
Gv5vICw5vGDWv/1Rb9muCMQ4wcEW/c/YFEU0FM3VFTgJ+fQrA4ZO/NjpRSixiGDk
uVkJ25Fo2TMp58ITPWmT3Nj1MJ0x9xNzMxXhLk2JgK/sEMH+/Giju8Zq7XojHHC0
QluYmz1V3EClPXiArkcgt/pagQ24b5yYmOAKGQGHEdRM18QWeJzJ4kUBzATcUVjv
RWkLHz69emH6aQ3JNwyuEQlK/Xda3ge2zMIJ4tYObg21dEFdgqnFoLFrylCUkgIE
T86QPQfb0HGTRhnSjdh/NN5qyiOo9q4FzpIsI3eJ3XJgk0/T/O8Rv+2fexAm0g3+
37kgkxohETi6RQc3D4ClpmW7bP1DEK8uUwUGeJgCNmkpE4DVpLmGZ0tNbSf/0Mk6
slYSHb6dF6wNB4AV/1HIusp6i2GlPziNYkhlslkRQgeyXO9T1bWxYqdkYihDFLRs
PStlk1Diu0p+h3r08sX3LQrszBp1bLGkqaipFPLBwWStxYne9nsClORFhN4q9i+4
fAnWxIRBXH62fJTy1DCPFqpI9zyvQTkVHQVKu5d+JgaTmTPsfJ3MIXdkGdAEV6+m
xbZSFwd2e8uzPIlZke2JmaT4xVv1T92lWu7Ywf8M0eEYWg5WQi8=OHm5
-----END PGP SIGNATURE-----