Описание
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In cifs_query_reparse_point(), the start >= end check before casting to
struct reparse_data_buffer * only ensures the start pointer is within the
response. It fails to verify that there is enough space remaining for the
fixed 8-byte header of the structure.
If a server provides a DataOffset that leaves less than 8 bytes remaining,
the check passes, but subsequent reads of ReparseTag and ReparseDataLength
will occur out-of-bounds.
Fix this by ensuring the remaining space is at least the size of the
reparse_data_buffer structure before accessing its fields.
A flaw was found in the Linux kernel's Server Message Block (SMB) client. In the reparse point query handling logic, the client fails to properly validate response buffer boundaries before accessing data structures. A malicious or compromised SMB server can exploit this by returning a crafted response with an invalid data offset, triggering an out-of-bounds memory read. This issue can lead to a system crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.
Отчет
A moderate out-of-bounds read flaw was found in the Linux kernel SMB client as shipped in newer Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams. In cifs_query_reparse_point(), when processing a query reparse point response, the client validates only that the computed start pointer lies within the response buffer; it does not verify that the 8 bytes required for the fixed reparse_data_buffer header remain. A malicious or compromised SMB server can return a crafted response whose DataOffset leaves fewer than 8 bytes remaining, causing the client to read the ReparseTag and ReparseDataLength fields out of bounds. This can crash the kernel, resulting in a denial of service, and may in principle expose out-of-bounds memory contents, although no direct information disclosure is demonstrated. Exploitation requires the client to connect to and query reparse points from an attacker-controlled or compromised SMB server, which is reflected in the Moderate rating (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced by downstream backports into recent streams only: RHEL 9.8, 9.9, and 9.10, RHEL 10.2, 10.3, and 10.4, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 are affected. Older streams, including RHEL 6, 7, and 8, RHEL 9.2, 9.4, and 9.6, and RHEL 10.0, do not contain the vulnerable code and are not affected. The fix is currently deferred for the affected streams and will be addressed in a future update rather than an immediate erratum; until a fix is released, the residual risk is a kernel crash (denial of service) on systems that mount or access SMB shares from untrusted servers.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
EPSS
5.5 Medium
CVSS3