Versions Affected : All versions prior to TrueNAS 12.0-U6

---

Description

The ggatec(8) daemon does not validate the size of a response before writing it to a fixed-sized buffer. This allows to overwrite the stack of ggatec(8).

A malicious ggated(8) or an attacker in a priviledged network position can overwrite the stack with crafted content and potentially execute arbitrary code.

---

Workaround

No workaround is available.

---

Mitigation

• Upgrade to TrueNAS 12.0-U6 or later.

---

Commit

• FreeBSD Revision : r370394
• TrueNAS Commit : c4a8aad
• JIRA Ticket : NAS-111999

---

Further information

• FreeBSD Errata Notice Entry