Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2018-17159: FreeBSD NFS server can be forced to use unlimited memory
CVE-2018-17159 · published 7 years ago
Summary
The NFS file‑sharing service in FreeBSD versions prior to the specified updates does not properly limit the size of a READDIRPLUS request. An attacker who can connect to the NFS server can cause it to allocate huge amounts of memory, slowing or crashing the system. Update FreeBSD to the patched releases or restrict NFS access to trusted hosts to prevent this condition.
What to do
- Update freebsd freebsd to version 11.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| freebsd | freebsd |
< 11.2 11.2 cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* |
Original advisory text
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged remote users with access to the NFS server can cause a r...
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged remote users with access to the NFS server can cause a resource exhaustion by forcing the server to allocate an arbitrarily large memory allocation.
References
- http://www.securityfocus.com/bid/106192 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1042164 Third Party Advisory VDB Entry
- https://secuniaresearch.flexerasoftware.com/secunia_research/2018-24/ Third Party Advisory
- https://security.freebsd.org/advisories/FreeBSD-SA-18:13.nfs.asc Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published4 Dec 2018
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-17159 · NVD
Track software like this
Free during beta