Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler to store the return in an int ret variable. This bug would eventually result in a crash when dereference the invalid error pointer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to < aa37f5fef78dd11cbf983269da2031e12625c56daffectedd08089f649a0cfb2099c8551ac47eef0cc23fdf2 to < cad756733dc3985188983f3e2eb77e2927209099affectedd08089f649a0cfb2099c8551ac47eef0cc23fdf2 to < a187883cc1dc784a4d32537f5d316f1b7b9ad76faffectedd08089f649a0cfb2099c8551ac47eef0cc23fdf2 to < a1cc432cb0b0a1f74f98a0db3b94ca880c7947acaffectedd08089f649a0cfb2099c8551ac47eef0cc23fdf2 to < 61f28012e5650c619223decdb7970e0d3162e949affected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/aa37f5fef78dd11cbf983269da2031e12625c56d ↗
- https://git.kernel.org/stable/c/cad756733dc3985188983f3e2eb77e2927209099 ↗
- https://git.kernel.org/stable/c/a187883cc1dc784a4d32537f5d316f1b7b9ad76f ↗
- https://git.kernel.org/stable/c/a1cc432cb0b0a1f74f98a0db3b94ca880c7947ac ↗
- https://git.kernel.org/stable/c/61f28012e5650c619223decdb7970e0d3162e949 ↗