Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing. This is a minimal fix to guard the initial handle read.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0626e6641f6b467447c81dd7678a69c66f7746cf to < a02e432d5130da4c723aabe1205bac805889fdb2affected0626e6641f6b467447c81dd7678a69c66f7746cf to < 2dc125f5da134c0915a840b62565c60a595673ddaffected0626e6641f6b467447c81dd7678a69c66f7746cf to < 898d527ed94c19980a4d848f10057f1fed578ffbaffected0626e6641f6b467447c81dd7678a69c66f7746cf to < 867ffd9d67285612da3f0498ca618297f8e41f01affected0626e6641f6b467447c81dd7678a69c66f7746cf to < 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected6.1.158 to ≤ 6.1.*unaffected6.6.115 to ≤ 6.6.*unaffected6.12.56 to ≤ 6.12.*unaffected6.17.6 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a02e432d5130da4c723aabe1205bac805889fdb2 ↗
- https://git.kernel.org/stable/c/2dc125f5da134c0915a840b62565c60a595673dd ↗
- https://git.kernel.org/stable/c/898d527ed94c19980a4d848f10057f1fed578ffb ↗
- https://git.kernel.org/stable/c/867ffd9d67285612da3f0498ca618297f8e41f01 ↗
- https://git.kernel.org/stable/c/6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0 ↗