Read the docs
TI-2024-07565 Aliases CVE-2024-8158GHSA-pm23-3px3-qrh7

User impersonation for lib9p based 9p fileservers

Priority MEDIUM 44CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

A bug in the 9p authentication implementation within lib9p allows an attacker with an existing valid user within the configured auth server to impersonate any other valid filesystem user. This is due to lib9p not properly verifying that the uname given in the Tauth and Tattach 9p messages matches the client UID returned from the factotum authentication handshake. The only filesystem making use of these functions within the base 9front systems is the experimental hjfs disk filesystem, other disk filesystems (cwfs and gefs) are not affected by this bug. This bug was inherited from Plan 9 and is present in all versions of 9front and is remedied fully in commit 9645ae07eb66a59015e3e118d0024790c37400da.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed 9front (9front): 9645ae07eb66a59015e3e118d0024790c37400da

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
9front9frontbefore 9645ae07eb66a59015e3e118d0024790c37400da9645ae07eb66a59015e3e118d0024790c37400daPatch availableCNA
  • 9front Vendor9front Affected before 9645ae07eb66a59015e3e118d0024790c37400da Fixed in 9645ae07eb66a59015e3e118d0024790c37400da Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:9front:lib9p:*:*:*:*:*:*:*:*before 2024-08-24Vulnerable9front
  • cpe:2.3:a:9front:lib9p:*:*:*:*:*:*:*:* Versions before 2024-08-24 Vulnerable ·9front

Remediation

  • Fix · CNA 9front (9front) Fixed in 9645ae07eb66a59015e3e118d0024790c37400da

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8158
  2. 2026-10-03 Alias added: GHSA-pm23-3px3-qrh7

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences