Описание
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden POSIX SID length parsing
posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden POSIX SID length parsing
posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-64380
- https://git.kernel.org/stable/c/0de5b8e76847f5de26f364a82c6602c4881c30da
- https://git.kernel.org/stable/c/171605aed68380c2fa75dff9b3a1ed427c50065b
- https://git.kernel.org/stable/c/4213c1208978483021d7d125c131de3985d38f61
- https://git.kernel.org/stable/c/427eb7eb46425fec845a43e861f3d6e2899cae59
- https://git.kernel.org/stable/c/46a84715a015cb48e1b9c219dc88c03d8a541ea4
- https://git.kernel.org/stable/c/7ad2bcf2441430bb2e918fb3ef9a90d775a6e422
- https://git.kernel.org/stable/c/86c5d470f5d42e61123b2f4b4f0b91f4eee5b980
- https://git.kernel.org/stable/c/96e889bc1e759c83f25093e8c2f3da31b4973f30
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
A flaw was found in the Linux kernel's Server Message Block (SMB) client. The vulnerability exists in the `posix_info_sid_size()` function, which is responsible for parsing POSIX Security Identifiers (SIDs). An insufficient boundary check allows the system to accept truncated POSIX SIDs, which could lead to unexpected behavior or a denial of service. This issue has been resolved by requiring at least two bytes before reading the subauthority count, ensuring that all client paths safely reject malformed SIDs.
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
In the Linux kernel, the following vulnerability has been resolved: s ...