Описание
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential OOB read in smb3_enum_snapshots()
If snapshot_array_size is smaller than GMT_TOKEN_SIZE,
smb3_enum_snapshots() sets ret_data_len to
sizeof(struct smb_snapshot_array) without verifying the actual length
of the server's reply.
Because SMB2_ioctl() places no lower bound on the server-supplied
OutputCount and allocates retbuf to exactly that length, a short reply
results in ret_data_len exceeding the size of retbuf. The subsequent
copy_to_user() then reads past the end of retbuf, leaking adjacent slab
memory to userspace. The subsequent clamp check is ineffective as it
only reduces ret_data_len.
Fix this by rejecting replies shorter than
sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set
to the 12-byte struct size rather than the 16-byte
MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes
is exactly what copy_to_user() attempts to read.
A flaw was found in the Linux kernel's Server Message Block (SMB) client. This issue leads to information disclosure caused by an out-of-bounds memory read during snapshot enumeration. A malicious SMB server can provide an unexpectedly short response, causing the kernel client to read beyond the allocated buffer and leak adjacent kernel memory to local user space.
Отчет
An out-of-bounds read in the Linux kernel SMB client's snapshot enumeration results in a moderate-impact information disclosure affecting Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift Container Platform. When a local user enumerates snapshots on a mounted SMB share, smb3_enum_snapshots() sets the reply data length to the 12-byte size of struct smb_snapshot_array without validating the actual length of the server's response. Because SMB2_ioctl() allocates the return buffer to exactly the server-supplied output count, a malicious or compromised SMB server (or an attacker able to intercept SMB traffic) can return an abnormally short reply, causing the subsequent copy_to_user() to read past the end of the buffer and disclose a small amount of adjacent kernel slab memory to the calling local user's process. The flaw does not modify memory or cause a crash. Red Hat rates this flaw Moderate severity, lower than the upstream CVE.org Important rating (CVSS 7.1), because exploitation requires a local user on a system with an SMB share mounted from a rogue server (or whose SMB traffic is intercepted), and the disclosure is limited to a few bytes of adjacent kernel slab memory, which at worst could assist in attempts to defeat kernel address space layout randomization. RHEL 8, 9, and 10 kernels (including kernel-rt), Red Hat In-Vehicle OS 2 kernels, and the RHEL CoreOS 8/9 kernels shipped in OpenShift Container Platform 4.12 and later are affected, with the fix deferred to a future scheduled update given the moderate severity and limited practical exploitability of the flaw. RHEL 6 and 7 ELS kernel and kernel-rt are not affected because the vulnerable code is not present in those streams. The residual risk of deferral is the small kernel memory disclosure described above, limited to systems where local users can access SMB mounts backed by untrusted servers.
Меры по смягчению последствий
Exploitation requires a local user with access to a mounted SMB share whose server returns a truncated snapshot-enumeration reply. As a mitigation, mount SMB shares only from trusted servers, avoid SMB traffic over untrusted networks, and restrict local access to systems with SMB mounts. Beyond these precautions, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability; the fix will be delivered in a future kernel update.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.
smb: client: fix potential OOB read in smb3_enum_snapshots()
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.
EPSS
5.5 Medium
CVSS3