Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0. Skip the equal case.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f44158485826c076335d6860d35872271a83791d to < 52fcbb92e0d3acfd1448b2a43b6595d540da5295affectedf44158485826c076335d6860d35872271a83791d to < da29cd197246c85c0473259f1cad897d9d28faeaaffectedf44158485826c076335d6860d35872271a83791d to < a6f4cfa3783804336491e0edcb250c25f9b59d33affectedf44158485826c076335d6860d35872271a83791d to < 571204e4758a528fbd67330bd4b0dfbdafb33dd8affectedf44158485826c076335d6860d35872271a83791d to < 5d510ac31626ed157d2182149559430350cf2104affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected6.1.160 to ≤ 6.1.*unaffected6.6.120 to ≤ 6.6.*unaffected6.12.64 to ≤ 6.12.*unaffected6.18.3 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/52fcbb92e0d3acfd1448b2a43b6595d540da5295 ↗
- https://git.kernel.org/stable/c/da29cd197246c85c0473259f1cad897d9d28faea ↗
- https://git.kernel.org/stable/c/a6f4cfa3783804336491e0edcb250c25f9b59d33 ↗
- https://git.kernel.org/stable/c/571204e4758a528fbd67330bd4b0dfbdafb33dd8 ↗
- https://git.kernel.org/stable/c/5d510ac31626ed157d2182149559430350cf2104 ↗