| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| cifs: Fix buffer overflow when parsing NFS reparse points |
| |
| ReparseDataLength is sum of the InodeType size and DataBuffer size. |
| So to get DataBuffer size it is needed to subtract InodeType's size from |
| ReparseDataLength. |
| |
| Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer |
| at position after the end of the buffer because it does not subtract |
| InodeType size from the length. Fix this problem and correctly subtract |
| variable len. |
| |
| Member InodeType is present only when reparse buffer is large enough. Check |
| for ReparseDataLength before accessing InodeType to prevent another invalid |
| memory access. |
| |
| Major and minor rdev values are present also only when reparse buffer is |
| large enough. Check for reparse buffer size before calling reparse_mkdev(). |
| |
| The Linux kernel CVE team has assigned CVE-2024-49996 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 5.4.287 with commit 7b222d6cb87077faf56a687a72af1951cf78c8a9 |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 5.10.231 with commit 73b078e3314d4854fd8286f3ba65c860ddd3a3dd |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 5.15.174 with commit 01cdddde39b065074fd48f07027757783cbf5b7d |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 6.1.120 with commit ec79e6170bcae8a6036a4b6960f5e7e59a785601 |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 6.6.55 with commit c6db81c550cea0c73bd72ef55f579991e0e4ba07 |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 6.10.14 with commit 803b3a39cb096d8718c0aebc03fd19f11c7dc919 |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 6.11.3 with commit c173d47b69f07cd7ca08efb4e458adbd4725d8e9 |
| Issue introduced in 5.3 with commit d5ecebc4900df7f6e8dff0717574668885110553 and fixed in 6.12 with commit e2a8910af01653c1c268984855629d71fb81f404 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-49996 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/smb/client/reparse.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7b222d6cb87077faf56a687a72af1951cf78c8a9 |
| https://git.kernel.org/stable/c/73b078e3314d4854fd8286f3ba65c860ddd3a3dd |
| https://git.kernel.org/stable/c/01cdddde39b065074fd48f07027757783cbf5b7d |
| https://git.kernel.org/stable/c/ec79e6170bcae8a6036a4b6960f5e7e59a785601 |
| https://git.kernel.org/stable/c/c6db81c550cea0c73bd72ef55f579991e0e4ba07 |
| https://git.kernel.org/stable/c/803b3a39cb096d8718c0aebc03fd19f11c7dc919 |
| https://git.kernel.org/stable/c/c173d47b69f07cd7ca08efb4e458adbd4725d8e9 |
| https://git.kernel.org/stable/c/e2a8910af01653c1c268984855629d71fb81f404 |
