Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock_break_cancelled, offload, and status_file_deleted fields are stored in the same bitfield byte in struct cifsFileInfo, but are updated in different code paths that may run simultaneously, and are protected by different locks. Since bitfield assignments generate byte-level read-modify-write operations, a modification to one flag can overwrite a concurrent modification to another flag. To avoid these races, convert these flags from a bitfield to separate bool fields.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < f255e87b4f7eda568c37d6eae5db1d1a8aca5968affected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < 7fa619367869be705942f087b2ecd209efc78fe1affected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < e961baf9c1a4f2e93a55f8eb2c6151fc27b96a4caffected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < 3b8e7928cf1928555dc05d172dd02fb0e7692ec4affected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < 3786ee67658a2c80fef2544e7de2cd329e043cf9affected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < 4165641d06ef44f3a31b77a28048b6c737e885e7affected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < d9d23d115610e0342e768f6cb525d91c7b154027affected3bc303c254335dbd7c7012cc1760b12f1d5514d3 to < 19465a9aeb664f1d710d0d22c07c31bfb7c85446affected
Linux Linux
Default version status: affected
2.6.32affected0 to < 2.6.32unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f255e87b4f7eda568c37d6eae5db1d1a8aca5968 ↗
- https://git.kernel.org/stable/c/7fa619367869be705942f087b2ecd209efc78fe1 ↗
- https://git.kernel.org/stable/c/e961baf9c1a4f2e93a55f8eb2c6151fc27b96a4c ↗
- https://git.kernel.org/stable/c/3b8e7928cf1928555dc05d172dd02fb0e7692ec4 ↗
- https://git.kernel.org/stable/c/3786ee67658a2c80fef2544e7de2cd329e043cf9 ↗
- https://git.kernel.org/stable/c/4165641d06ef44f3a31b77a28048b6c737e885e7 ↗
- https://git.kernel.org/stable/c/d9d23d115610e0342e768f6cb525d91c7b154027 ↗
- https://git.kernel.org/stable/c/19465a9aeb664f1d710d0d22c07c31bfb7c85446 ↗