Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7449d736bbbd160c76b01b8fcdf72f58a8757d4b to < dffb44b2e06a2908e249f0f93156fc987eee1d1caffectedea41367b2a602f602ea6594fc4a310520dcc64f4 to < 9b3af35645ff9cd334edc130249f9a2fb2bea25faffectedea41367b2a602f602ea6594fc4a310520dcc64f4 to < 512d33bc8ea4ea5c19728ee118715f4b1f4d1926affectedea41367b2a602f602ea6594fc4a310520dcc64f4 to < a16f70a71be4b5a4eccf39a9bf09b47285f4cb7caffectedea41367b2a602f602ea6594fc4a310520dcc64f4 to < 8d09328dfda089675e4c049f3f256064a1d1996baffected6.6.32 to < 6.6.140affected
Linux Linux
Default version status: affected
6.9affected0 to < 6.9unaffected6.6.140 to ≤ 6.6.*unaffected6.12.88 to ≤ 6.12.*unaffected6.18.30 to ≤ 6.18.*unaffected7.0.7 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/dffb44b2e06a2908e249f0f93156fc987eee1d1c ↗
- https://git.kernel.org/stable/c/9b3af35645ff9cd334edc130249f9a2fb2bea25f ↗
- https://git.kernel.org/stable/c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926 ↗
- https://git.kernel.org/stable/c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c ↗
- https://git.kernel.org/stable/c/8d09328dfda089675e4c049f3f256064a1d1996b ↗