Bugzilla – Bug 1213545
VUL-0: kernel-source-rt,kernel-source,kernel-source-azure: ksmbd Session Setup Out-Of-Bounds Read Information Disclosure Vulnerability
Last modified: 2024-06-25 17:50:49 UTC
ZDI-23-981 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. Upstream fix: https://github.com/torvalds/linux/commit/98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 The specific flaw exists within the handling of session setup commands. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. References: https://www.zerodayinitiative.com/advisories/ZDI-23-981/
stable doesn't have the fix afaics
(In reply to Thomas Leroy from comment #1) > stable doesn't have the fix afaics commit 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 [v6.5-rc1~104^2~4] Author: Namjae Jeon <linkinjeon@kernel.org> Date: Sat Jun 24 12:33:09 2023 +0900 ksmbd: fix out of bounds read in smb2_sess_setup stable [v6.4, need backporting]
Hi Paulo, Because this issue relates to samba. Could you please help to handle it? If this is not in your area, just reset but assigner to kernel-bugs@suse.de. Kernel Security Sentinel will find other expert. Thanks a lot!
(In reply to Joey Lee from comment #2) > (In reply to Thomas Leroy from comment #1) > > stable doesn't have the fix afaics > > commit 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 [v6.5-rc1~104^2~4] > Author: Namjae Jeon <linkinjeon@kernel.org> > Date: Sat Jun 24 12:33:09 2023 +0900 > > ksmbd: fix out of bounds read in smb2_sess_setup > > stable [v6.4, need backporting] found that the 98422bdd4c be backported to stable. patches.kernel.org/6.4.5-008-ksmbd-fix-out-of-bounds-read-in-smb2_sess_setup.patch Just need to update References tag in 6.4.5-008-ksmbd-fix-out-of-bounds-read-in-smb2_sess_setup.patch to add bsc#1213545.
Thanks for sharing the document! Reassigning to security team to close it.
done, closing