Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated. Close the handle after a post-CREATE context parsing failure so the error path releases the remote resource and balances the open count.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
13fb0fc4917621f3dfa285a27eaf7151d770b5e5 to < d4c05b5cb0a3132453e36a300d45de44bf6783c4affected890bc4fac3c0973a49cac35f634579bebba7fe48 to < ee61f1dc516d97afa79908140d0a8c556c2fe90caffected1ae3c59355dc9882e09c020afe8ffbd895ad0f29 to < 007b87f6a7c38959ed79cf7d3fd7b3b4eb5f67fdaffected17a0f64cc02d4972e21c733d9f21d1c512963afa to < eaa97a196a107d4ef8775df2248181624151812eaffectedaf1689a9b7701d9907dfc84d2a4b57c4bc907144 to < 80c67cc71d32ccafc89a29b669243b40d81b930faffectedaf1689a9b7701d9907dfc84d2a4b57c4bc907144 to < f09875ff901e933e7b22c913daf51d21e9d93a45affectedaf1689a9b7701d9907dfc84d2a4b57c4bc907144 to < cdb36b09fb1f86d638d0afb44d621ed3f7c1d8ebaffectedaf1689a9b7701d9907dfc84d2a4b57c4bc907144 to < 566820af017e81497fb5e9d3ad6e7ffe2828bc8baffected6726429c18c62dbf5e96ebbd522f262e016553fbaffected5.10.211 to < 5.10.273affected5.15.150 to < 5.15.224affected6.1.79 to < 6.1.191affected6.6.8 to < 6.6.160affected5.4.277 to < 5.5affected
Linux Linux
Default version status: affected
6.7affected0 to < 6.7unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d4c05b5cb0a3132453e36a300d45de44bf6783c4 ↗
- https://git.kernel.org/stable/c/ee61f1dc516d97afa79908140d0a8c556c2fe90c ↗
- https://git.kernel.org/stable/c/007b87f6a7c38959ed79cf7d3fd7b3b4eb5f67fd ↗
- https://git.kernel.org/stable/c/eaa97a196a107d4ef8775df2248181624151812e ↗
- https://git.kernel.org/stable/c/80c67cc71d32ccafc89a29b669243b40d81b930f ↗
- https://git.kernel.org/stable/c/f09875ff901e933e7b22c913daf51d21e9d93a45 ↗
- https://git.kernel.org/stable/c/cdb36b09fb1f86d638d0afb44d621ed3f7c1d8eb ↗
- https://git.kernel.org/stable/c/566820af017e81497fb5e9d3ad6e7ffe2828bc8b ↗