Bugzilla – Bug 1213421
VUL-0: CVE-2023-38426: kernel-source,kernel-source-azure,kernel-source-rt: fix global-out-of-bounds in smb2_find_context_vals
Last modified: 2024-05-29 12:10:35 UTC
CVE-2023-38426 An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38426 https://www.cve.org/CVERecord?id=CVE-2023-38426 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/ksmbd?id=02f76c401d17e409ed45bf7887148fcc22c93c85
Only stable is affected
(In reply to Thomas Leroy from comment #1) > Only stable is affected Actually, stable already has the fix
(In reply to Thomas Leroy from comment #2) > (In reply to Thomas Leroy from comment #1) > > Only stable is affected > > Actually, stable already has the fix Update status: - stable [v6.4, already included] But, the fs/ksmbd be moved to fs/smb/server since v6.4: From 38c8a9a52082579090e34c033d439ed2cd1a462d Mon Sep 17 00:00:00 2001 [v6.4-rc4~22^2~2] From: Steve French <stfrench@microsoft.com> Date: Sun, 21 May 2023 20:46:30 -0500 Subject: smb: move client and server files to common directory fs/smb Move CIFS/SMB3 related client and server files (cifs.ko and ksmbd.ko and helper modules) to new fs/smb subdirectory: fs/cifs --> fs/smb/client fs/ksmbd --> fs/smb/server fs/smbfs_common --> fs/smb/common Which means that 15-SP5 or older SLE may still need 02f76c401d patch. I found that 15-SP5 has 38c8a9a52082 but no 02f76c401d.
Hi Paulo, Because this issue relates to samba. Could you please help to handle it? If this is not in your area, just reset but assigner to kernel-bugs@suse.de. Kernel Security Sentinel will find other expert. Thanks a lot!
(In reply to Joey Lee from comment #3) > (In reply to Thomas Leroy from comment #2) > > (In reply to Thomas Leroy from comment #1) > > > Only stable is affected > > > > Actually, stable already has the fix > > Update status: > - stable [v6.4, already included] > > > But, the fs/ksmbd be moved to fs/smb/server since v6.4: > > From 38c8a9a52082579090e34c033d439ed2cd1a462d Mon Sep 17 00:00:00 2001 > [v6.4-rc4~22^2~2] > From: Steve French <stfrench@microsoft.com> > Date: Sun, 21 May 2023 20:46:30 -0500 > Subject: smb: move client and server files to common directory > fs/smb > > Move CIFS/SMB3 related client and server files (cifs.ko and ksmbd.ko > and helper modules) to new fs/smb subdirectory: > > fs/cifs --> fs/smb/client > fs/ksmbd --> fs/smb/server > fs/smbfs_common --> fs/smb/common > > Which means that 15-SP5 or older SLE may still need 02f76c401d patch. I > found that 15-SP5 has 38c8a9a52082 but no 02f76c401d. I just found that the CONFIG_SMB_SERVER is NOT set in 15-SP5. So we don't need the patch in 15-SP5. Reset assigner.
(In reply to Joey Lee from comment #5) .... > I just found that the CONFIG_SMB_SERVER is NOT set in 15-SP5. So we don't > need the patch in 15-SP5. > > Reset assigner. Hi Joey, is Leap 15.4 ok? Thanks, Simon
(In reply to Simon Logan from comment #6) > (In reply to Joey Lee from comment #5) > .... > > I just found that the CONFIG_SMB_SERVER is NOT set in 15-SP5. So we don't > > need the patch in 15-SP5. > > > > Reset assigner. > > Hi Joey, is Leap 15.4 ok? > > Thanks, > Simon I see https://www.suse.com/security/cve/CVE-2023-38426.html says SUSE Linux Enterprise Desktop 15 SP4 Not affected SUSE Linux Enterprise Server 15 SP4 Not affected
(In reply to Simon Logan from comment #6) > (In reply to Joey Lee from comment #5) > .... > > I just found that the CONFIG_SMB_SERVER is NOT set in 15-SP5. So we don't > > need the patch in 15-SP5. > > > > Reset assigner. > > Hi Joey, is Leap 15.4 ok? > > Thanks, > Simon I also didn't see CONFIG_SMB_SERVER be set in 15-SP4 kernel. And Leap 15.4 direct uses SLE15-SP4 kernel. So Leap 15.4 is also not affected.
(In reply to Joey Lee from comment #8) > I also didn't see CONFIG_SMB_SERVER be set in 15-SP4 kernel. And Leap 15.4 > direct uses SLE15-SP4 kernel. So Leap 15.4 is also not affected. Thanks Joey. Simon
All done, closing.