OpenAFS CVE-2024-10397 Preallocated Buffer Overflow in XDR Responses

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-10397 2. Vulnerability Name: Preallocated buffer overflows in XDR responses 3. Affected Software Versions: - OpenAFS clients running versions 1.0 through 1.6.24 - 1.8.0 through 1.8.12.2 - 1.9.0 through 1.9.1 4. Affected Software: OpenAFS 5. Vulnerability Description: - A malicious server can cause the OpenAFS cache manager and other client tools to crash, and may lead to arbitrary code execution. - Multiple RPCs used by OpenAFS return dynamically-sized strings, buffers, and arrays as output parameters. Callers of these RPCs may provide pre-allocated memory to store the results. In some cases, callers provide pre-allocated buffers smaller than the size limits defined in the RPC interface. If the server’s response data exceeds the size of the pre-allocated buffer, the XDR encoder will write beyond the buffer’s boundaries, causing errors, crashes, or potentially code execution. 6. Impact: - Depending on local configuration, unauthorized local users may be able to contact a malicious vserver or file server to trigger a buffer overflow in the cache manager. For Unix cache managers, this could result in a crash or arbitrary code execution in kernel mode. - If the daemon is run without the option, malicious cells can trigger buffer overflows, but the cache manager can only contact cells configured in the local CellServDB or manually via (an operation that can only be successfully executed by root). - Malicious users with the ability to modify network packets can also trigger buffer overflows by modifying responses from legitimate servers. - On Solaris kernel clients, malicious cells can also trigger system crashes or memory corruption. 7. Affected Software Versions: - All OpenAFS versions from 1.6.24 to 1.8.12.2, and from 1.9.0 to 1.9.1. 8. Remediation: - It is recommended that all affected clients and tools be upgraded to OpenAFS version 1.6.25 or 1.8.13. - For sites unable or unwilling to upgrade, patches are available to address the issue. - Restricting user access to remote cells on the cache manager, disabling the or options when running , can prevent unauthorized processes from being easily exploited. Disabling the option when running can prevent any local process from being easily exploited. 9. Detailed Information: - When RPCs define output parameters as strings, opaque, or arrays, the corresponding functions , , , or are used to decode server responses. All of these can use pre-allocated buffers to store decoded data, but none check whether the provided buffer is large enough to hold the response. For strings, it is impossible to check if the buffer is large enough, since the caller does not pass the buffer size. - If the caller provides a pre-allocated buffer that is greater than or equal to the interface-defined size, overflow is impossible. Otherwise, the relevant XDR function may store more data than the buffer can hold, causing a buffer overflow. - Some RPCs effectively use pre-allocated output parameters within retry/backoff loops, even if they are not explicitly designed for it. For example, Unix and WINNT cache managers include calls to that look like this: - If the first call to fills the parameter and breaks the loop, we may attempt to call again, passing the same array allocated in the first call. This allows triggering a buffer overflow in the heap if the next call returns an array larger than the one allocated previously. - All RPCs called via wrappers (e.g., ) are also affected, even if they do not pass pre-allocated output parameters, because the underlying RPC may be called multiple times. This primarily affects user-space utilities that contact known servers (vos, pts, aklog), so it is generally less of a security concern. - Another issue related to strings may occur in Solaris kernel code: - Strings in XDR are encoded with a length prefix followed by the string content. However, when frees the string, it calculates the buffer size and then calls to determine how much to free. If the server responds with a string of length N that contains a NUL byte within its content, will allocate N+1 bytes of memory, then attempt to free the buffer via with a size of N or less. - Most platforms ignore the size parameter passed to , but Solaris passes it to . If an incorrect size is passed to , this can lead to a kernel crash or memory corruption. This information provides a detailed description of the preallocated buffer overflow vulnerability in OpenAFS, including affected software, exploitation conditions, scope of impact, and mitigation measures.

Goal Reached Thanks to every supporter — we hit 100%!

OpenAFS CVE-2024-10397 Preallocated Buffer Overflow in XDR Responses