CVE-2024-6759: NFS client accepts file names containing path separators

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-12 · updated 2026-06-17
Weakness: CWE-22

Description

When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir(3) and related functions to return filesystem entries with names containing additional path components. The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.

Affected products

FreeBSD: before 13.0; from 13.1 before 13.3; 13.3-p1, 13.3-p2, 13.3-p3, 13.3-p4, 14.0-beta5, 14.0-p1 (+11) — fixed in 13.0, 13.3

How to fix

Upgrade to a fixed version: FreeBSD 13.0, 13.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-6759 or the next vulnerability affects your stack