libnfs ZDR decoding flaw can crash the library or run code
Original title: USN-9008-1: libnfs vulnerability
Ubuntu says missing maximum-size enforcement during ZDR decoding causes an out-of-bounds write in libnfs.
Ubuntu security notice USN-9008-1 says libnfs did not properly enforce the maximum size bound during ZDR decoding, resulting in an out-of-bounds write. An attacker could possibly crash libnfs, causing a denial of service, or execute arbitrary code. The notice snippet does not name a CVE, affected versions, or a fix.
Unconfirmed: The snippet does not identify a CVE, affected releases, or whether exploitation is known.
- The defect is an out-of-bounds write during ZDR decoding.
- Described impact is a crash or possible arbitrary code execution.
- No affected release or fixed version appears in the snippet.
Impact: Denial of service or possible arbitrary code execution
| Product | Affected |
|---|---|
| libnfs | — |
From the original article
It was discovered that libnfs did not properly enforce the maximum size bound during ZDR decoding, resulting in an out-of-bounds write. An attacker could possibly use this issue to cause libnfs to crash, resulting in a denial of service, or execute arbitrary code.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.