FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Uninitialized kernel stack leaks in several file systems

Affected packages
12.2 <= FreeBSD-kernel < 12.2_3
12.1 <= FreeBSD-kernel < 12.1_13
11.4 <= FreeBSD-kernel < 11.4_7

Details

VuXML ID a9c6e9be-61fb-11eb-b87a-901b0ef719ab
Discovery 2021-01-29
Entry 2021-01-29

Problem Description:

Several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems. This problem is not present in FreeBSD 11.

Additionally, msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

Impact:

Kernel stack disclosures may leak sensitive information which could be used to compromise the security of the system.

References

CVE Name CVE-2020-25578
CVE Name CVE-2020-25579
FreeBSD Advisory SA-21:01.fsdisclosure