CVE-2022-49271

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cifs: prevent bad output lengths in smb2_ioctl_query_info()

When calling smb2_ioctl_query_info() with

smb_query_info::flags=PASSTHRU_FSCTL and

smb_query_info::output_buffer_length=0, the following would return

0x10

buffer = memdup_user(arg + sizeof(struct smb_query_info),

qi.output_buffer_length);

if (IS_ERR(buffer)) {

kfree(vars);

return PTR_ERR(buffer);

}

rather than a valid pointer thus making IS_ERR() check fail. This

would then cause a NULL ptr deference in @buffer when accessing it

later in smb2_ioctl_query_ioctl(). While at it, prevent having a

@buffer smaller than 8 bytes to correctly handle SMB2_SET_INFO

FileEndOfFileInformation requests when

smb_query_info::flags=PASSTHRU_SET_INFO.

Here is a small C reproducer which triggers a NULL ptr in @buffer when

passing an invalid smb_query_info::flags

#include <stdio.h>

#include <stdlib.h>

#include <stdint.h>

#include <unistd.h>

#include <fc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References