Get a Quote   (408) 943-4100               TrueNAS Discord      VendOp_Icon_15x15px   Commercial Support
TrueNAS.com Software Systems Company Community Security iX Portal Download

FreeBSD fs
core
TrueNAS 12.0

Versions Affected : All versions prior to TrueNAS 12.0-U2

Description

The FreeBSD kernel exports file system directory entries to userspace using the generic “dirent” structure.

Individual file systems implement VOP_READDIR to convert from the file system’s internal directory entry layout to the generic form. dirent structures can be fetched from userspace using the getdirentries(2) system call. Several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems. This problem is not present in FreeBSD 11. Additionally, msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

Workaround

No workaround is available.

Mitigation

  • Upgrade to TrueNAS 12.0-U2 or later.

Commit

Further information