Description
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rejetto | hfs2 | 2.0.0 – ≤ 2.4.0 | — |
References
- https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-getini-infinite-loop-dos/README.md technical-description exploit
- VulnCheck Advisory third-party-advisory