Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0. Skip the equal case.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected f44158485826c076335d6860d35872271a83791d before 52fcbb92e0d3acfd1448b2a43b6595d540da5295; affected f44158485826c076335d6860d35872271a83791d before da29cd197246c85c0473259f1cad897d9d28faea; affected f44158485826c076335d6860d35872271a83791d before a6f4cfa3783804336491e0edcb250c25f9b59d33; affected f44158485826c076335d6860d35872271a83791d before 571204e4758a528fbd67330bd4b0dfbdafb33dd8; affected f44158485826c076335d6860d35872271a83791d before 5d510ac31626ed157d2182149559430350cf2104 |
| Linux / Linux | affected 5.15; unaffected 0 before 5.15; unaffected 6.1.160 through 6.1.*; unaffected 6.6.120 through 6.6.*; unaffected 6.12.64 through 6.12.*; unaffected 6.18.3 through 6.18.*; unaffected 6.19 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/52fcbb92e0d3acfd1448b2a43b6595d540da5295
- https://git.kernel.org/stable/c/da29cd197246c85c0473259f1cad897d9d28faea
- https://git.kernel.org/stable/c/a6f4cfa3783804336491e0edcb250c25f9b59d33
- https://git.kernel.org/stable/c/571204e4758a528fbd67330bd4b0dfbdafb33dd8
- https://git.kernel.org/stable/c/5d510ac31626ed157d2182149559430350cf2104