Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer. The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared. ksmbd does not implement quota tracking, so report no control flags.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 995456b5e703e128904a6cbc8b3347eb3d04c72caffectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < c78aea8984c84767e87f677477e4784deb8adfdeaffectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < e8b82184a1982894820a91a72ac9857ddd5dffbfaffectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 370459776468fc68c97008360108f381e3120953affectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < d8c450ad0d08980b39b08d435efa921086c8b227affectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 03bb4338c3a7c3fc4decf699a35753f0891aab2aaffectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8eaffected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.161 to ≤ 6.6.*unaffected6.12.115 to ≤ 6.12.*unaffected6.18.59 to ≤ 6.18.*unaffected7.2.13 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/995456b5e703e128904a6cbc8b3347eb3d04c72c ↗
- https://git.kernel.org/stable/c/c78aea8984c84767e87f677477e4784deb8adfde ↗
- https://git.kernel.org/stable/c/e8b82184a1982894820a91a72ac9857ddd5dffbf ↗
- https://git.kernel.org/stable/c/370459776468fc68c97008360108f381e3120953 ↗
- https://git.kernel.org/stable/c/d8c450ad0d08980b39b08d435efa921086c8b227 ↗
- https://git.kernel.org/stable/c/03bb4338c3a7c3fc4decf699a35753f0891aab2a ↗
- https://git.kernel.org/stable/c/c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e ↗