Description

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T16:17:37.690Z",
  "pubdate": "2026-09-01T16:17:37.690Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists within the AFP (Apple Filing Protocol) backend of the gvfs component. The flaw originates from insufficient validation of length fields provided by an AFP server during the DSI (Data Stream Interface) read process.\nA malicious AFP server can exploit this vulnerability by supplying a length value that exceeds the pre-allocated reply buffer. This leads to out-of-bounds memory access, resulting in a heap buffer overflow.\nThe primary impact is a denial-of-service (DoS) condition, manifesting as a crash of the gvfsd-afp process. This vulnerability is triggered upon mounting a malicious share, making it highly relevant for environments where users interact with untrusted network storage.\nSuccessful exploitation requires the victim to connect to a malicious or compromised AFP server. While currently identified as a crash vector, heap overflows often carry the potential for arbitrary code execution depending on the state of the heap allocator and memory layout at the time of the overflow.\nThere are no specific privilege requirements beyond the user initiating the AFP mount; however, the impact is localized to the gvfsd-afp process running within the user's session.",
  "technicalDetails": "The vulnerability resides in the gvfs AFP backend, specifically within the DSI read path functionality. The DSI protocol serves as the transport layer for AFP, facilitating communication between the client and the server. The issue manifests when the client receives a reply from the server that includes a length parameter which is not properly verified against the destination buffer size.\nThe root cause is a lack of boundary checking in the logic that handles incoming DSI packets. When the gvfsd-afp process allocates a reply buffer of a fixed or calculated size based on the expected transaction, it fails to perform a rigorous comparison between the 'length' field provided by the server in the DSI header and the actual memory allocated for the incoming data payload. Consequently, if a malicious server sends a DSI packet claiming a length greater than the allocated heap space, the read operation proceeds to write the excess data into adjacent memory regions on the heap.\nThe exploitation flow proceeds as follows: First, an attacker establishes a listening AFP server designed to act maliciously. Second, the victim initiates a mount request to this server using gvfs. Third, upon receipt of a request, the malicious server responds with a crafted DSI packet containing an intentionally oversized length field. Fourth, the gvfsd-afp process, upon processing this header, attempts to read the data into the target buffer without performing a bounds check against the buffer's capacity. Finally, the buffer overflow occurs as data is written past the end of the heap-allocated memory, causing memory corruption that terminates the gvfsd-afp process, resulting in a crash.\nThis vulnerability is particularly concerning due to the nature of network-backed file systems which are often accessed by users without deep inspection of the remote server's protocol compliance. Because gvfs runs as a user-space process, the crash disrupts file system services for that specific user. Beyond simple DoS, the overflow of heap buffers can, in complex scenarios, be leveraged to overwrite adjacent heap metadata or function pointers, potentially transitioning the impact from simple process termination to arbitrary code execution within the context of the user running gvfsd-afp."
}