-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

============================================================================= FreeBSD-SA-24:09.libnv Security Advisory
The FreeBSD Project

Topic: Multiple vulnerabilities in libnv

Category: core
Module: libnv
Announced: 2024-09-04
Credits: Taylor R Campbell (NetBSD, CVE-2024-45287)
Synacktiv (CVE-2024-45287, CVE-2024-45288)
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 12:24:56 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:27 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:12 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 12:24:12 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:13:10 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:40 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-45287, CVE-2024-45288

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

I. Background

libnv (also called nvlist) is a general-purpose library designed for storing name-value pairs. This library can serve as an Inter-Process Communication (IPC) framework, enabling processes to exchange data. For example, it is
used in libcasper to communicate between privileged and unprivileged
processes. Additionally, libnv can function as an interface for communication between userland and kernel.

Originally, libnv was inspired by OpenZFS nvlist. However, the
implementations are separate. This advisory is only about base system implementation of libnv, not a OpenZFS one.

II. Problem Description

CVE-2024-45287 is a vulnerability that affects both the kernel and userland.
A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data.

CVE-2024-45288 is a vulnerability that affects both the kernel and userland.
A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.

III. Impact

It is possible for an attacker to overwrite portions of memory (in userland
or the kernel) as the allocated buffer might be smaller than the data
received from a malicious process. This vulnerability could result in
privilege escalation or cause a system panic.

IV. Workaround

No workaround is available.

V. Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.

Perform one of the following:

1) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-24:09/libnv.patch
# fetch https://security.FreeBSD.org/patches/SA-24:09/libnv.patch.asc
# gpg --verify libnv.patch.asc

b) Apply the patch. Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

d) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI. Correction details

This issue is corrected as of the corresponding Git commit hash in the following stable and release branches:

Branch/path Hash Revision
- ------------------------------------------------------------------------- stable/14/ 9c2ef102166e stable/14-n268655 releng/14.1/ d87f821959fb releng/14.1-n267696 releng/14.0/ b219ce1c5a93 releng/14.0-n265433 stable/13/ 03bef9971d73 stable/13-n258309 releng/13.4/ 3aa9be7e3334 releng/13.4-n258240 releng/13.3/ 33b4e2361c82 releng/13.3-n257449
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45287>

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45288>

The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:09.libnv.asc> -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54cACgkQbljekB8A Gu8YLRAAmpVVVib8RgEj0bKS5qNLwujEssMIO96LS73txcFGm/Iy+QJA/N/SRtDL lnKRi0ya90pBmXXhX03Uei+O/nBAFxkCxCukuQ36bauJrA74RFgn/8ZK63RbvdDE K+xAyK71FXLTr+wGqyzv0xOxNA60dl14WiyaLCUX++0DU3EesmVD508wIL7Ls/bS 5g5vllxmELV2zXYXY/DbEVHS/i2YRCs8ftasa92uXVgOibODVpL/GSXy1QHyykNQ ODAmGjs+p0xf2JDJa2qvokMh4WS4HkGe4W/TcJueTiSbsdOrDDhOV/n0QTgwt1rQ zq2QQU3tk2unYjhQrR6ZvHTbFCKc7G3BVFCPAZ6fSthq834EoCr2LUGyYhU+bLZ6 SweQfCP48ExjIqvDzQqMOlvp9rMiLbxpjkdDcsml4zhD2GE+byuT6RSRBqq3tBvT 893YoIiW1m069DnAQxh1Zlewsk/BZFeeXBHZdk4Ik5KYFCwCabV3HLFa9hA1/iKx 5ITULL0gZgZKBQ9IbpkL45q9mcDHXrVuMPfA0a3bb38rpoK5uof25+oKSGGvWyDA plGXuEh5Sltmx0lOdY2O70j8pLh7bVJCyo5rYDhObzQlWiajUx1pH3M9DePbI+Rk Z+Gby0zKpXzgSfHSiSyfVPgDMa83yDpiozRMszjpvApB7h/hekQ=
=yX5r
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)