smb: client: fix potential OOB read in smb3_enum_snapshots()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.10, 4.15, 4.19, 6.1.189, 6.6.158, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From e02789a53d71334b067ad72eee5d4e88a0158083 · fixed in 15a221c734b9d044ab769e7e3606b2cab96fb65a; From e02789a53d71334b067ad72eee5d4e88a0158083 · fixed in 74995ee8305a7c4d76ee70d6acd996a75eda3c03; From e02789a53d71334b067ad72eee5d4e88a0158083 · fixed in 210f0f1f67817e7d2348b86b5115a9b85ef5c98b; From e02789a53d71334b067ad72eee5d4e88a0158083 · fixed in 1cdf0d304d820fb13bf0faf532c3459600f9ea43; From e02789a53d71334b067ad72eee5d4e88a0158083 · fixed in dbe452a905dfe2804647530a9ff3d7e3826ed04d; From e02789a53d71334b067ad72eee5d4e88a0158083 · fixed in 4775c3b7a597907e0b97556c7986fda238a377ae; From 4.9.125 · fixed in 4.10; From 4.14.68 · fixed in 4.15; From 4.18.6 · fixed in 4.19
- Linux Linux
4.19
- KernelLinux
From 4.19.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8