Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds check currently adds OutputOffset and qi.input_buffer_length directly, so the addition can wrap in 32-bit arithmetic before the result is compared against the response buffer length. A malicious server can use a large OutputOffset and a small OutputCount to make the wrapped sum pass the bounds check. The later copy_to_user() then reads from io_rsp + OutputOffset, outside the response buffer. Use size_add() for the offset plus length check so overflow is treated as out of bounds.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 2b1116bbe898aefdf584838448c6869f69851e0f before 175357ee0c596cb82054650dfa32fda51ad35aaa; affected 2b1116bbe898aefdf584838448c6869f69851e0f before dbd126539c098dba3159ce7d34b10b2daddcbd0f; affected 2b1116bbe898aefdf584838448c6869f69851e0f before 63feb687e89a3a52a31e6e01764117cc500f1974; affected 2b1116bbe898aefdf584838448c6869f69851e0f before 160045fc943f6c46b227644261252c8a22b8a87a; affected 2b1116bbe898aefdf584838448c6869f69851e0f before b30771b69eafae750afb7385fbcc3d77ed3f3670; affected 2b1116bbe898aefdf584838448c6869f69851e0f before 1627e7d5c9b09721a141d07cedb178882f1ded67; affected 2b1116bbe898aefdf584838448c6869f69851e0f before 1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9; affected 2b1116bbe898aefdf584838448c6869f69851e0f before a4f27ad055392fa164f5649e89a3637b033c5fcc; affected 2005c32ec99ee2490e8131b3953f3f212009ffea; affected 5.4.69 before 5.5 |
| Linux / Linux | affected 5.5; unaffected 0 before 5.5; unaffected 5.10.261 through 5.10.*; unaffected 5.15.212 through 5.15.*; unaffected 6.1.178 through 6.1.*; unaffected 6.6.145 through 6.6.*; unaffected 6.12.97 through 6.12.*; unaffected 6.18.40 through 6.18.*; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/175357ee0c596cb82054650dfa32fda51ad35aaa
- https://git.kernel.org/stable/c/dbd126539c098dba3159ce7d34b10b2daddcbd0f
- https://git.kernel.org/stable/c/63feb687e89a3a52a31e6e01764117cc500f1974
- https://git.kernel.org/stable/c/160045fc943f6c46b227644261252c8a22b8a87a
- https://git.kernel.org/stable/c/b30771b69eafae750afb7385fbcc3d77ed3f3670
- https://git.kernel.org/stable/c/1627e7d5c9b09721a141d07cedb178882f1ded67
- https://git.kernel.org/stable/c/1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9
- https://git.kernel.org/stable/c/a4f27ad055392fa164f5649e89a3637b033c5fcc
ADP enrichment
No English description supplied.
No references supplied.