Dear Maintainer,

Just found out, the latest security update for Debian v11, breaks command bos.

Any attempt to run "bos status <server>" returns:

bos: running unauthenticated
bos: failed to contact host's bosserver (RPC interface mismatch (-451)).

I did not test any of the other options of command bos.  I have been
told that bos is the only broken command with this update.

Hi Jose,
bosserver running? Are there clients/server in the cell, that are still
vulnerable to CVE-2024-10397?
I assume that this newly added check:
tconfig.cacheConfig_len != sizeof(cm_initparams_v1)/sizeof(afs_uint32)

in src/libadmin/adminutil/afs_utilAdmin:util_CMClientConfig() is failing.
Probably your server and client disagree on the size of some structs.

   Thorsten

code is mostly unused in terms of the actual binaries that we ship.

I would be looking more closely at the xdr_string() change in src/rx/xdr.c
(note the commit message there specifically refers to several callsites in
bos.c that rely on the behavior of functions that make use of
xdr_string()).

The "OPENAFS-SA-2024-003: xdr: Prevent XDR_DECODE buffer overruns" change
is also touching some potentially relevant code, as does
"OPENAFS-SA-2024-003: xdr: Ensure correct string length in xdr_string".

So more information about the cell would be helpful in trying to track down
what is happening.

I can reproduce this; it happens with 1.8.6-5+deb11u1 specifically, not
1.8.9-1+deb12u1. I don't think there's anything special about the target
server; it shouldn't require any particular version.

It looks like 1.8.6-5+deb11u1 doesn't have upstream commit
5abea9b8b1164f203fe18b5abe7d64ac8cb514eb (bos: Let xdr allocate rpc
output strings), included in upstream 1.8.8. Without that, bos tries to
reuse the string buffer for various rpc output arguments, which is
prohibited by the "xdr: Prevent XDR_DECODE buffer overruns" commit,
mentioned by Ben:

Hi,

Thank you for the quick reply and analisys of the problem.