CyberRota Analysis
AI-GeneratedA vulnerability in the SFTP backend of gvfs allows a malicious SFTP server to manipulate the length of data processed during file reads, leading to potential heap memory corruption. This flaw can result in denial of service when the gvfsd-sftp process crashes or, in some cases, may enable arbitrary code execution. Organizations using gvfs for file sharing should prioritize patching this vulnerability to mitigate the associated risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.