CVE-2024-50151

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOBs when building SMB2_IOCTL request

When using encryption, either enforced by the server or when using

'seal' mount option, the client will squash all compound request buffers

down for encryption into a single iov in smb2_set_next_command().

SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the

SMB2_IOCTL request in the first iov, and if the user passes an input

buffer that is greater than 328 bytes, smb2_set_next_command() will

end up writing off the end of @rqst->iov[0].iov_base as shown below:

mount.cifs //srv/share /mnt -o ...,seal

ln -s $(perl -e "print('a')for 1..1024") /mnt/link

BUG: KASAN: slab-out-of-bounds in

smb2_set_next_command.cold+0x1d6/0x24c [cifs]

Write of size 4116 at addr ffff8881148fcab8 by task ln/859

CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS

1.16.3-2.fc40 04/01/2014

Call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References