CVE-2026-4747: FreeBSD RPCSEC_GSS RCE Vulnerability

CVE-2026-4747 Overview

CVE-2026-4747 is a stack buffer overflow vulnerability in FreeBSD's RPCSEC_GSS implementation that can lead to remote code execution. The vulnerability exists in the routine that validates RPCSEC_GSS data packets by checking a signature in the packet. This routine copies a portion of the packet into a stack buffer without properly ensuring that the buffer is sufficiently large to accommodate the data, allowing a malicious client to trigger a stack overflow.

Critical Impact

Remote code execution is possible in the kernel when kgssapi.ko is loaded and the NFS server is accessible. Userspace applications running RPC servers with librpcgss_sec loaded are also vulnerable to remote code execution from any client able to send packets.

Affected Products

• FreeBSD systems with kgssapi.ko kernel module loaded
• FreeBSD systems running NFS server with RPCSEC_GSS authentication
• Userspace applications with librpcgss_sec loaded running RPC servers

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-4747 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4747

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow). The flaw resides in the packet signature validation routine within FreeBSD's RPCSEC_GSS implementation. When processing incoming RPCSEC_GSS data packets, the validation routine allocates a fixed-size buffer on the stack to hold a portion of the packet data. However, the routine fails to verify that the incoming data will fit within this buffer before performing the copy operation.

The vulnerability is particularly severe because it does not require the client to authenticate itself before exploitation. An authenticated user who can send packets to the kernel's NFS server can achieve kernel-level remote code execution while kgssapi.ko is loaded. This provides attackers with the highest level of system access.

Root Cause

The root cause is improper bounds checking in the RPCSEC_GSS packet validation code. The validation routine copies packet data into a stack-allocated buffer without first comparing the size of the incoming data against the buffer's capacity. This missing size validation allows attackers to provide specially crafted packets with oversized signature data, causing the copy operation to write beyond the buffer boundary and corrupt adjacent stack memory.

Attack Vector

The attack is network-accessible and can be executed by authenticated users with the ability to send packets to vulnerable services. The attack does not require user interaction and exploits the following attack path:

1. Attacker identifies a FreeBSD system running NFS with kgssapi.ko loaded or an RPC server application with librpcgss_sec
2. Attacker crafts a malicious RPCSEC_GSS packet with an oversized signature field
3. The packet is sent to the target service, triggering the signature validation routine
4. The validation routine copies the malicious data into the undersized stack buffer
5. Stack memory is corrupted, potentially allowing control of instruction pointer
6. Attacker achieves remote code execution with kernel privileges (if targeting kgssapi.ko) or user privileges (if targeting userspace applications)

The vulnerability mechanism involves the improper handling of packet signature data in the RPCSEC_GSS validation routine. When a packet is received, the routine extracts signature data and copies it to a stack buffer for verification. The absence of proper length checks before this copy operation enables stack-based buffer overflow conditions. For detailed technical information, see the FreeBSD Security Advisory.

Detection Methods for CVE-2026-4747

Indicators of Compromise

• Unexpected crashes or kernel panics related to kgssapi.ko or NFS services
• Anomalous network traffic patterns targeting NFS ports (typically port 2049)
• RPC server processes exhibiting unexpected behavior or memory corruption symptoms
• System logs showing repeated RPCSEC_GSS authentication or validation errors

Detection Strategies

• Monitor NFS and RPC service logs for unusual authentication patterns or malformed packet errors
• Implement network intrusion detection rules to identify oversized or malformed RPCSEC_GSS packets
• Deploy endpoint detection and response (EDR) solutions to detect stack overflow exploitation attempts
• Use kernel auditing to monitor for suspicious activity involving kgssapi.ko

Monitoring Recommendations

• Enable verbose logging for NFS and RPC services to capture detailed packet processing information
• Monitor system stability metrics for unexpected kernel panics or service crashes
• Implement network traffic analysis focusing on RPC protocol anomalies
• Configure alerts for any unauthorized code execution attempts in kernel context

How to Mitigate CVE-2026-4747

Immediate Actions Required

• Apply the latest FreeBSD security patches addressing CVE-2026-4747 immediately
• If patching is not immediately possible, consider temporarily disabling kgssapi.ko if RPCSEC_GSS authentication is not required
• Restrict network access to NFS services using firewall rules to trusted clients only
• Audit all systems for the presence of kgssapi.ko and librpcgss_sec in running environments

Patch Information

FreeBSD has released a security advisory addressing this vulnerability. Administrators should apply the patches described in the FreeBSD Security Advisory FreeBSD-SA-26:08.rpcsec_gss. Review the advisory for specific patch instructions and affected FreeBSD versions.

Workarounds

• Unload the kgssapi.ko kernel module if RPCSEC_GSS authentication is not required for NFS operations
• Use firewall rules to restrict access to NFS services to trusted networks and hosts only
• Consider alternative authentication mechanisms for NFS that do not rely on RPCSEC_GSS
• Implement network segmentation to isolate systems running NFS servers from untrusted networks

# Configuration example - Unload kgssapi.ko module if not required
kldunload kgssapi.ko

# Add to /etc/rc.conf to prevent automatic loading
echo 'kgssapi_load="NO"' >> /boot/loader.conf

# Restrict NFS access via firewall (example using ipfw)
ipfw add deny tcp from any to any dst-port 2049 in
ipfw add allow tcp from 192.168.1.0/24 to any dst-port 2049 in