Vulnerability-Lookup

CVE-2024-6759 (GCVE-0-2024-6759)

Vulnerability from cvelistv5 – Published: 2024-08-11 02:45 – Updated: 2024-08-16 17:02

Title

NFS client accepts file names containing path separators

Summary

When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir(3) and related functions to return filesystem entries with names containing additional path components. The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-12 14:14 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

freebsd mitre root

References

2 references

URL	Tags
https://security.freebsd.org/advisories/FreeBSD-S…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024081…

Impacted products

4 products

Vendor	Product	Version	CPE status
FreeBSD	FreeBSD	Affected: 14.1-RELEASE , < p3 (release) Affected: 14.0-RELEASE , < p9 (release) Affected: 13.3-RELEASE , < p5 (release)	guessed
freebsd	freebsd	Affected: 14.1 , < 14.1p3 (custom) cpe:2.3:o:freebsd:freebsd:14.1:::::::*
freebsd	freebsd	Affected: 14.0 , < 14.0p9 (custom) cpe:2.3:o:freebsd:freebsd:13.3:::::::*
freebsd	freebsd	Affected: 13.3 , < 13.3p5 (custom) cpe:2.3:o:freebsd:freebsd:13.3:::::::*

Date Public

2024-08-07 15:00

Credits

Apple Security Engineering and Architecture (SEAR)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:freebsd:freebsd:14.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "freebsd",
            "vendor": "freebsd",
            "versions": [
              {
                "lessThan": "14.1p3",
                "status": "affected",
                "version": "14.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "freebsd",
            "vendor": "freebsd",
            "versions": [
              {
                "lessThan": "14.0p9",
                "status": "affected",
                "version": "14.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "freebsd",
            "vendor": "freebsd",
            "versions": [
              {
                "lessThan": "13.3p5",
                "status": "affected",
                "version": "13.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-6759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T14:14:46.215475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T14:24:35.396Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-16T17:02:45.727Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20240816-0009/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "nfsclient"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p3",
              "status": "affected",
              "version": "14.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p9",
              "status": "affected",
              "version": "14.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p5",
              "status": "affected",
              "version": "13.3-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Apple Security Engineering and Architecture (SEAR)"
        }
      ],
      "datePublic": "2024-08-07T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-11T02:45:15.024Z",
        "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "shortName": "freebsd"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NFS client accepts file names containing path separators",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
    "assignerShortName": "freebsd",
    "cveId": "CVE-2024-6759",
    "datePublished": "2024-08-11T02:45:15.024Z",
    "dateReserved": "2024-07-15T14:18:19.971Z",
    "dateUpdated": "2024-08-16T17:02:45.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-6759",
      "date": "2026-09-23",
      "epss": "0.00676",
      "percentile": "0.50854"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "18A4E85D-70A5-4382-AAB7-4A531615613D",
                  "versionEndExcluding": "13.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FEC367A5-24D1-414E-BC77-07968E787D01",
                  "versionEndExcluding": "13.3",
                  "versionStartIncluding": "13.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
                  "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
                  "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
                  "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
                  "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
                  "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
                  "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
                  "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
                  "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
                  "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
                  "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
                  "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
                  "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
                  "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
                  "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
                  "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
                  "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory."
        },
        {
          "lang": "es",
          "value": "Al montar un sistema de archivos remoto usando NFS, el kernel no desinfect\u00f3 los nombres de archivos proporcionados de forma remota para el car\u00e1cter separador de ruta, \"/\". Esto permite que readdir(3) y funciones relacionadas devuelvan entradas del sistema de archivos con nombres que contienen componentes de ruta adicionales. La falta de validaci\u00f3n descrita anteriormente da lugar a un confuso problema de diputados. Por ejemplo, se podr\u00eda enga\u00f1ar a un programa que copia archivos desde un montaje NFS para que los copie desde fuera del directorio de origen previsto y/o a una ubicaci\u00f3n fuera del directorio de destino previsto."
        }
      ],
      "id": "CVE-2024-6759",
      "lastModified": "2024-11-21T09:50:15.657",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 1.4,
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 1.4,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-08-12T13:38:40.380",
      "references": [
        {
          "source": "secteam@freebsd.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://security.netapp.com/advisory/ntap-20240816-0009/"
        }
      ],
      "sourceIdentifier": "secteam@freebsd.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "modules": [
                  "nfsclient"
                ],
                "product": "FreeBSD",
                "vendor": "FreeBSD",
                "versions": [
                  {
                    "lessThan": "p3",
                    "status": "affected",
                    "version": "14.1-RELEASE",
                    "versionType": "release"
                  },
                  {
                    "lessThan": "p9",
                    "status": "affected",
                    "version": "14.0-RELEASE",
                    "versionType": "release"
                  },
                  {
                    "lessThan": "p5",
                    "status": "affected",
                    "version": "13.3-RELEASE",
                    "versionType": "release"
                  }
                ]
              }
            ],
            "source": "secteam@freebsd.org"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:o:freebsd:freebsd:14.1:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "freebsd",
                "vendor": "freebsd",
                "versions": [
                  {
                    "lessThan": "14.1p3",
                    "status": "affected",
                    "version": "14.1",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "freebsd",
                "vendor": "freebsd",
                "versions": [
                  {
                    "lessThan": "14.0p9",
                    "status": "affected",
                    "version": "14.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "freebsd",
                "vendor": "freebsd",
                "versions": [
                  {
                    "lessThan": "13.3p5",
                    "status": "affected",
                    "version": "13.3",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18A4E85D-70A5-4382-AAB7-4A531615613D",
                    "versionEndExcluding": "13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FEC367A5-24D1-414E-BC77-07968E787D01",
                    "versionEndExcluding": "13.3",
                    "versionStartIncluding": "13.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
                    "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
                    "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
                    "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
                    "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
                    "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
                    "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
                    "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
                    "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
                    "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
                    "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
                    "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
                    "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
                    "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
                    "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
                    "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
                    "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory."
          },
          {
            "lang": "es",
            "value": "Al montar un sistema de archivos remoto usando NFS, el kernel no desinfect\u00f3 los nombres de archivos proporcionados de forma remota para el car\u00e1cter separador de ruta, \"/\". Esto permite que readdir(3) y funciones relacionadas devuelvan entradas del sistema de archivos con nombres que contienen componentes de ruta adicionales. La falta de validaci\u00f3n descrita anteriormente da lugar a un confuso problema de diputados. Por ejemplo, se podr\u00eda enga\u00f1ar a un programa que copia archivos desde un montaje NFS para que los copie desde fuera del directorio de origen previsto y/o a una ubicaci\u00f3n fuera del directorio de destino previsto."
          }
        ],
        "id": "CVE-2024-6759",
        "lastModified": "2026-06-17T08:18:39.407",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-6759",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T14:14:46.215475Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-12T13:38:40.380",
        "references": [
          {
            "source": "secteam@freebsd.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.netapp.com/advisory/ntap-20240816-0009/"
          }
        ],
        "sourceIdentifier": "secteam@freebsd.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T19:43:31+00:00",
      "cve": "CVE-2024-6759",
      "id": "CVE-2024-6759",
      "initial_release_date": "2024-08-07T15:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "NFS client accepts file names containing path separators",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-6759.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-16T17:02:45.727Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://security.netapp.com/advisory/ntap-20240816-0009/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:o:freebsd:freebsd:14.1:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "freebsd",
                "vendor": "freebsd",
                "versions": [
                  {
                    "lessThan": "14.1p3",
                    "status": "affected",
                    "version": "14.1",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "freebsd",
                "vendor": "freebsd",
                "versions": [
                  {
                    "lessThan": "14.0p9",
                    "status": "affected",
                    "version": "14.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "freebsd",
                "vendor": "freebsd",
                "versions": [
                  {
                    "lessThan": "13.3p5",
                    "status": "affected",
                    "version": "13.3",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 5.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-6759",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-12T14:14:46.215475Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-22",
                    "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-12T14:24:23.074Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "modules": [
                "nfsclient"
              ],
              "product": "FreeBSD",
              "vendor": "FreeBSD",
              "versions": [
                {
                  "lessThan": "p3",
                  "status": "affected",
                  "version": "14.1-RELEASE",
                  "versionType": "release"
                },
                {
                  "lessThan": "p9",
                  "status": "affected",
                  "version": "14.0-RELEASE",
                  "versionType": "release"
                },
                {
                  "lessThan": "p5",
                  "status": "affected",
                  "version": "13.3-RELEASE",
                  "versionType": "release"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Apple Security Engineering and Architecture (SEAR)"
            }
          ],
          "datePublic": "2024-08-07T15:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-11T02:45:15.024Z",
            "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
            "shortName": "freebsd"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "NFS client accepts file names containing path separators",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109",
        "assignerShortName": "freebsd",
        "cveId": "CVE-2024-6759",
        "datePublished": "2024-08-11T02:45:15.024Z",
        "dateReserved": "2024-07-15T14:18:19.971Z",
        "dateUpdated": "2024-08-16T17:02:45.727Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-06778 (CVE-2024-6759)

Vulnerability from fstec – Published: 2024-09-09 – Updated: 2024-09-09 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции readdir(3) операционной системы FreeBSD, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость функции readdir(3) операционной системы FreeBSD связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity

5.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-22 - Неверное ограничение имени пути к каталогу с ограниченным доступом («Обход пути»)

Aliases

CVE-2024-6759

References

1 reference

URL
https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc

Impacted products

1 product from 1 vendor

Vendors

FreeBSD Project

Products

FreeBSD

Versions

14.0 beta5 (FreeBSD), 14.0 rc3 (FreeBSD), 14.0 rc4-p1 (FreeBSD), 14.1 p1 (FreeBSD), до 13.0 (FreeBSD), от 13.1 до 13.3 (FreeBSD), от 13.3:p1 до 13.3:p4 (FreeBSD), от 14.0:p1 до 14.0:p8 (FreeBSD), 14.1 p2 (FreeBSD)

Product types

Operating system

Platforms

FreeBSD Project FreeBSD 14.0 beta5, FreeBSD Project FreeBSD 14.0 rc3, FreeBSD Project FreeBSD 14.0 rc4-p1, FreeBSD Project FreeBSD 14.1 p1, FreeBSD Project FreeBSD до 13.0, FreeBSD Project FreeBSD от 13.1 до 13.3, FreeBSD Project FreeBSD от 13.3:p1 до 13.3:p4, FreeBSD Project FreeBSD от 14.0:p1 до 14.0:p8, FreeBSD Project FreeBSD 14.1 p2

Mitigations

Использование рекомендаций производителя: https://www.freebsd.org/security/advisories/FreeBSD-SA-24:07.nfsclient.asc

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "FreeBSD Project",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "14.0 beta5 (FreeBSD), 14.0 rc3 (FreeBSD), 14.0 rc4-p1 (FreeBSD), 14.1 p1 (FreeBSD), \u0434\u043e 13.0 (FreeBSD), \u043e\u0442 13.1 \u0434\u043e 13.3 (FreeBSD), \u043e\u0442 13.3:p1 \u0434\u043e 13.3:p4 (FreeBSD), \u043e\u0442 14.0:p1 \u0434\u043e 14.0:p8 (FreeBSD), 14.1 p2 (FreeBSD)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.freebsd.org/security/advisories/FreeBSD-SA-24:07.nfsclient.asc",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.08.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "09.09.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "09.09.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-06778",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-6759",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FreeBSD",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "FreeBSD Project FreeBSD 14.0 beta5 , FreeBSD Project FreeBSD 14.0 rc3 , FreeBSD Project FreeBSD 14.0 rc4-p1 , FreeBSD Project FreeBSD 14.1 p1 , FreeBSD Project FreeBSD \u0434\u043e 13.0 , FreeBSD Project FreeBSD \u043e\u0442 13.1 \u0434\u043e 13.3 , FreeBSD Project FreeBSD \u043e\u0442 13.3:p1 \u0434\u043e 13.3:p4 , FreeBSD Project FreeBSD \u043e\u0442 14.0:p1 \u0434\u043e 14.0:p8 , FreeBSD Project FreeBSD 14.1 p2 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 readdir(3) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b FreeBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (\u00ab\u041e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438\u00bb) (CWE-22)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 readdir(3) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b FreeBSD \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-22",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}

FKIE_CVE-2024-6759

Vulnerability from fkie_nvd - Published: 2024-08-12 13:38 - Updated: 2026-06-17 08:18

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	secteam@freebsd.org	https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20240816-0009/

Impacted products

Vendor	Product	Version
freebsd	freebsd	*
freebsd	freebsd	*
freebsd	freebsd	13.3
freebsd	freebsd	13.3
freebsd	freebsd	13.3
freebsd	freebsd	13.3
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.0
freebsd	freebsd	14.1
freebsd	freebsd	14.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "nfsclient"
          ],
          "product": "FreeBSD",
          "vendor": "FreeBSD",
          "versions": [
            {
              "lessThan": "p3",
              "status": "affected",
              "version": "14.1-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p9",
              "status": "affected",
              "version": "14.0-RELEASE",
              "versionType": "release"
            },
            {
              "lessThan": "p5",
              "status": "affected",
              "version": "13.3-RELEASE",
              "versionType": "release"
            }
          ]
        }
      ],
      "source": "secteam@freebsd.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:freebsd:freebsd:14.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "freebsd",
          "vendor": "freebsd",
          "versions": [
            {
              "lessThan": "14.1p3",
              "status": "affected",
              "version": "14.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "freebsd",
          "vendor": "freebsd",
          "versions": [
            {
              "lessThan": "14.0p9",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:freebsd:freebsd:13.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "freebsd",
          "vendor": "freebsd",
          "versions": [
            {
              "lessThan": "13.3p5",
              "status": "affected",
              "version": "13.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18A4E85D-70A5-4382-AAB7-4A531615613D",
              "versionEndExcluding": "13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEC367A5-24D1-414E-BC77-07968E787D01",
              "versionEndExcluding": "13.3",
              "versionStartIncluding": "13.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*",
              "matchCriteriaId": "ABEA48EC-24EA-4106-9465-CE66B938635F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*",
              "matchCriteriaId": "8DFB5BD0-E777-4CAA-B2E0-3F3357D06D01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*",
              "matchCriteriaId": "BC8C769C-A23E-4F61-AC42-4DA64421B096",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:13.3:p4:*:*:*:*:*:*",
              "matchCriteriaId": "45B0589E-2E7D-4516-A8A0-88F30038EAB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "DB7B021E-F4AD-44AC-96AB-8ACAF8AB1B88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*",
              "matchCriteriaId": "69A72B5A-2189-4700-8E8B-1E5E7CA86C40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*",
              "matchCriteriaId": "5771F187-281B-4680-B562-EFC7441A8F88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*",
              "matchCriteriaId": "0A4437F5-9DDA-4769-974E-23BFA085E0DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*",
              "matchCriteriaId": "A9C3A3D4-C9F4-41EB-B532-821AF83470B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*",
              "matchCriteriaId": "878A1F0A-087F-47D7-9CA5-A54BB8D6676A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*",
              "matchCriteriaId": "CE73CDC3-B5A7-4921-89C6-8F9DC426CB3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*",
              "matchCriteriaId": "50A5E650-31FB-45BE-8827-641B58A83E45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:p8:*:*:*:*:*:*",
              "matchCriteriaId": "D59CFDD3-AEC3-43F1-A620-0B1F0BAD9048",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "038E5B85-7F60-4D71-8D3F-EDBF6E036CE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*",
              "matchCriteriaId": "BF309824-D379-4749-A1FA-BCB2987DD671",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*",
              "matchCriteriaId": "AA813990-8C8F-4EE8-9F2B-9F73C510A7B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.1:p2:*:*:*:*:*:*",
              "matchCriteriaId": "D4DFA201-27D5-4C01-B90F-E24778943C3B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory."
    },
    {
      "lang": "es",
      "value": "Al montar un sistema de archivos remoto usando NFS, el kernel no desinfect\u00f3 los nombres de archivos proporcionados de forma remota para el car\u00e1cter separador de ruta, \"/\". Esto permite que readdir(3) y funciones relacionadas devuelvan entradas del sistema de archivos con nombres que contienen componentes de ruta adicionales. La falta de validaci\u00f3n descrita anteriormente da lugar a un confuso problema de diputados. Por ejemplo, se podr\u00eda enga\u00f1ar a un programa que copia archivos desde un montaje NFS para que los copie desde fuera del directorio de origen previsto y/o a una ubicaci\u00f3n fuera del directorio de destino previsto."
    }
  ],
  "id": "CVE-2024-6759",
  "lastModified": "2026-06-17T08:18:39.407",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6759",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-12T14:14:46.215475Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-08-12T13:38:40.380",
  "references": [
    {
      "source": "secteam@freebsd.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240816-0009/"
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-96RC-H8F4-67GC

Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-12 18:30

Details

The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-6759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-12T13:38:40Z",
    "severity": "MODERATE"
  },
  "details": "When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, \"/\".  This allows readdir(3) and related functions to return filesystem entries with names containing additional path components.\n\nThe lack of validation described above gives rise to a confused deputy problem.  For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.",
  "id": "GHSA-96rc-h8f4-67gc",
  "modified": "2024-08-12T18:30:47Z",
  "published": "2024-08-12T15:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6759"
    },
    {
      "type": "WEB",
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-1793

Vulnerability from csaf_certbund - Published: 2024-08-07 22:00 - Updated: 2024-08-07 22:00

Summary

FreeBSD Project FreeBSD OS: Mehrere Schwachstellen

Severity

Hoch

Scope

4 vulnerabilities in this advisory, including CVE-2024-6759.

CVE-2024-6759

Es besteht eine Schwachstelle im FreeBSD Project FreeBSD OS. Dieser Fehler ist auf eine unsachgemäße Validierung von Dateinamen in der NFS-Implementierung zurückzuführen, wodurch Dateinamen mit zusätzlichen Pfad-Trennzeichen ("/") zurückgegeben werden können. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Informationen zu erlangen und Dateien zu modifizieren.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-6759 (GCVE-0-2024-6759)

BDU:2024-06778 (CVE-2024-6759)

FKIE_CVE-2024-6759

GHSA-96RC-H8F4-67GC

WID-SEC-W-2024-1793

Tags

Sightings

Nomenclature

Related by attack behaviour