CVE-2023-6881: 
NixOS vulnerability analysis and mitigation

A high-severity buffer overflow vulnerability (CVE-2023-6881) was discovered in the Zephyr File System's FUSE implementation. The vulnerability affects Zephyr versions 3.5 and earlier, specifically in the is_mount_point function within the FUSE filesystem access component (Zephyr Advisory).

The vulnerability exists in the is_mount_point function within the fuse_fs_access.c file. When a string of PATH_MAX length is passed via the path parameter, the sprintf function can cause a buffer overflow by one byte in the dir_path variable. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The vulnerability is classified as CWE-120 (Zephyr Advisory).

The vulnerability can lead to local attacks with low complexity, requiring no privileges or user interaction. It has potential impacts on confidentiality and integrity (both rated as Low) and a High impact on availability. The scope is unchanged, meaning the impact is confined to the same security scope as the vulnerable component (Zephyr Advisory).

The vulnerability requires local access to exploit, with low attack complexity. No special privileges or user interaction are required to exploit this vulnerability. The attack vector is local, making it necessary for an attacker to have local access to the affected system (Zephyr Advisory).

A patch has been submitted via pull request #66592 to address this vulnerability. As of February 20, 2024, there are no officially patched versions available. Users are advised to monitor for updates and apply patches when they become available (Zephyr Advisory).