Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
95907fea4fd8ccc736e0a428e52159b4d42b9958 to < 22886b1b7464613373c9a7d0af2ace029c50cd97affected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < 9d707a278c100c26d10fbbbd03988778ffc992ceaffected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < 90a13af4c9b1369327395bababfe87c75599cc19affected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < 61812323c037a94e2e7f0db7ee740c34b126bffeaffected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < d3546cecbf81d98bf3b472d341f981eb48c04f47affected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < 34a3942e787b9c59758115bd65fe1ec89d68c7a4affected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < 13efcd37a9b3d6ffa1579c3dda3e29c893ed9bcaaffected95907fea4fd8ccc736e0a428e52159b4d42b9958 to < eeb5ef6083e1cefa2ef75041b5597ff228b8d7bbaffected
Linux Linux
Default version status: affected
4.14affected0 to < 4.14unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/22886b1b7464613373c9a7d0af2ace029c50cd97 ↗
- https://git.kernel.org/stable/c/9d707a278c100c26d10fbbbd03988778ffc992ce ↗
- https://git.kernel.org/stable/c/90a13af4c9b1369327395bababfe87c75599cc19 ↗
- https://git.kernel.org/stable/c/61812323c037a94e2e7f0db7ee740c34b126bffe ↗
- https://git.kernel.org/stable/c/d3546cecbf81d98bf3b472d341f981eb48c04f47 ↗
- https://git.kernel.org/stable/c/34a3942e787b9c59758115bd65fe1ec89d68c7a4 ↗
- https://git.kernel.org/stable/c/13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca ↗
- https://git.kernel.org/stable/c/eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb ↗