Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives the sub_auth[2] read four bytes past the end of the ACE. Require num_subauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing compare_sids() semantics for the rest of cifsacl.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e2f8fbfb8d09c06decde162090fac3ee220aa280 to < 23b54d6cc3ef30a51d984dc74364f24039ae2ecbaffectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < 1592a6cd6f653f2d24572a6976c7a775b19f4940affectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < 8bd4cad3f458d11650d51c2d24b03fb1770ae6ccaffectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < b53b8e98c23310294fc45fc686db5ee860311896affectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < c8eef12af1cc73031639ea7cf16e0b10e2536b0baffectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < 38a69f08ee82c450d3e4168707fff2e317dc3ff7affectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < f8488c07bea2431ee12a6067d736578064fa46b4affectede2f8fbfb8d09c06decde162090fac3ee220aa280 to < 2757ad3e4b6f9e0fed4c7739594e702abc5cab21affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.84 to ≤ 6.12.*unaffected6.18.25 to ≤ 6.18.*unaffected7.0.2 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/23b54d6cc3ef30a51d984dc74364f24039ae2ecb ↗
- https://git.kernel.org/stable/c/1592a6cd6f653f2d24572a6976c7a775b19f4940 ↗
- https://git.kernel.org/stable/c/8bd4cad3f458d11650d51c2d24b03fb1770ae6cc ↗
- https://git.kernel.org/stable/c/b53b8e98c23310294fc45fc686db5ee860311896 ↗
- https://git.kernel.org/stable/c/c8eef12af1cc73031639ea7cf16e0b10e2536b0b ↗
- https://git.kernel.org/stable/c/38a69f08ee82c450d3e4168707fff2e317dc3ff7 ↗
- https://git.kernel.org/stable/c/f8488c07bea2431ee12a6067d736578064fa46b4 ↗
- https://git.kernel.org/stable/c/2757ad3e4b6f9e0fed4c7739594e702abc5cab21 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗