FreeBSD-SA-21:01.fsdisclosure : Uninitialized kernel stack leaks in several file systems
Versions Affected : All versions prior to TrueNAS 12.0-U2
The FreeBSD kernel exports file system directory entries to userspace using the generic “dirent” structure.
Individual file systems implement VOP_READDIR to convert from the file system’s internal directory entry layout to the generic form. dirent structures can be fetched from userspace using the getdirentries(2) system call. Several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems. This problem is not present in FreeBSD 11. Additionally, msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.
No workaround is available.
- Upgrade to TrueNAS 12.0-U2 or later.