smb: client: fix OOBs when building SMB2_IOCTL request
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enforced by the server or when using 'seal' mount option, the client will squash all compound request buffers down for encryption into a single iov in smb2_set_next_command(). SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the SMB2_IOCTL request in the first iov, and if the user passes an input buffer that is greater than 328 bytes, smb2_set_next_command() will end up writing off the end of @rqst->iov[0].iov_base as shown below: mount.cifs //srv/share /mnt -o ...,seal ln -s $(perl -e "print('a')for 1..1024") /mnt/link BUG: KASAN: slab-out-of-bounds in smb2_set_next_command.cold+0x1d6/0x24c [cifs] Write of size 4116 at addr ffff8881148fcab8 by task ln/859 CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: dump_stack_lvl+0x5d/0x80 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] print_report+0x156/0x4d9 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] ? __virt_addr_valid+0x145/0x310 ? __phys_addr+0x46/0x90 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] kasan_report+0xda/0x110 ? smb2_set_next_command.cold+0x1d6/0x24c [cifs] kasan_check_range+0x10f/0x1f0 __asan_memcpy+0x3c/0x60 smb2_set_next_command.cold+0x1d6/0x24c [cifs] smb2_compound_op+0x238c/0x3840 [cifs] ? kasan_save_track+0x14/0x30 ? kasan_save_free_info+0x3b
CVE-2024-50151
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-50151
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "6f0516ef1290da24b85461ed08a0938af7415e49",
"versionType": "git"
},
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "ed31aba8ce93472d9e16f5cff844ae7c94e9601d",
"versionType": "git"
},
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "e07d05b7f5ad9a503d9cab0afde2ab867bb65470",
"versionType": "git"
},
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "2ef632bfb888d1a14f81c1703817951e0bec5531",
"versionType": "git"
},
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "b209c3a0bc3ac172265c7fa8309e5d00654f2510",
"versionType": "git"
},
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "fe92ddc1c32d4474e605e3a31a4afcd0e7d765ec",
"versionType": "git"
},
{
"status": "affected",
"version": "e77fe73c7e38c36145825d84cfe385d400aba4fd",
"lessThan": "1ab60323c5201bef25f2a3dc0ccc404d9aca77f1",
"versionType": "git"
}
],
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.229",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.170",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.115",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.59",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.11.6",
"versionType": "semver",
"lessThanOrEqual": "6.11.*"
},
{
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-50151
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26791 · Revision 1
- Added to Heist Feed
- Publisher date