Description

A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap contents. If the server sends a short FXP_HANDLE reply, these uninitialized bytes are taken as the file handle. The client will then echo these uninitialized bytes back to the server on all subsequent requests using that handle. With a length of 128 bytes, this issue allows the malicious server to deterministically read uninitialized heap memory from the gvfsd-sftp process, leaking its heap base and the load address of the libgio library, resulting in a deterministic defeat of Address Space Layout Randomization (ASLR).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T16:17:37.007Z",
  "pubdate": "2026-09-01T16:17:37.007Z",
  "executiveSummary": "A critical heap-based information disclosure vulnerability exists in the SFTP backend of gvfs. The vulnerability stems from an improper handling of FXP_HANDLE responses during share mounting, where the application fails to validate the length of data read into a pre-allocated buffer.\nThis flaw allows a malicious SFTP server to trigger the read_string() function in gvfsd-sftp to process undersized replies, resulting in uninitialized heap memory being treated as legitimate file handle data.\nThe attacker can subsequently force the client to echo this sensitive data back to the server, enabling the deterministic exposure of process memory.\nThe impact is significant, as the leaked data includes critical memory addresses such as the heap base and the libgio library load address. This results in the complete bypass of Address Space Layout Randomization (ASLR) protections, facilitating more complex subsequent attacks against the gvfsd-sftp process.\nThe vulnerability requires a user to mount a malicious SFTP share, granting the server the capability to probe the client's internal memory state without prior authentication beyond the initial connection.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the read_string() function within the gvfsd-sftp component. During the SFTP mount handshake, the client expects the server to return an FXP_HANDLE; however, the logic fails to enforce a check to ensure that the allocated buffer is entirely populated with data received from the server.\nWhen a malicious SFTP server responds to a file handle request with a payload smaller than the allocated buffer length, the remainder of the 128-byte buffer persists with the residual contents of the process heap.\nBecause the function fails to validate the return length against the requested length, this uninitialized memory is treated as part of the valid file handle. The gvfsd-sftp process then caches this contaminated handle for subsequent I/O operations.\nThe exploitation flow is as follows: 1) The victim client connects to an attacker-controlled SFTP server. 2) The server requests an operation that triggers the vulnerable read_string() function. 3) The server sends a short FXP_HANDLE packet, causing the client to store a mix of attacker-controlled data and uninitialized heap memory as the handle. 4) The client initiates subsequent SFTP requests (such as read or write operations) using the tainted handle, which includes the uninitialized heap bytes.\nBecause the SFTP protocol requires the client to send the file handle back to the server in these subsequent requests, the server receives the sensitive uninitialized heap memory directly. By analyzing these packets, an attacker can extract pointers related to the heap base and the memory-mapped address of libgio.\nThis behavior results in a deterministic defeat of ASLR. By identifying the base addresses of key libraries and heap structures, an attacker can precisely craft subsequent exploitation payloads, such as ROP (Return-Oriented Programming) chains, to gain control over the execution flow of the gvfsd-sftp process.\nThe vulnerability is persistent across the lifecycle of the mounted share, as the handle is stored in memory and reused for every interaction with that specific directory structure, maximizing the attacker's window to collect sensitive memory dumps."
}