No description is available for this CVE.

A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows an attacker with attribute access to a file to bypass security checks when duplicating file extents. By using the FSCTL_DUPLICATE_EXTENTS_TO_FILE function, an attacker can copy the contents of a source file to a destination that they can read, leading to information disclosure.

A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a remote attacker to bypass intended access controls. By opening a file handle with limited write attributes, an attacker can use the SMB2 SET_INFO SECURITY operation to rewrite the file's access control list (DACL) and owner. This enables the attacker to grant themselves unauthorized permissions, leading to privilege escalation and potential unauthorized access to sensitive file operations.

A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a local attacker to escalate privileges by manipulating Server Message Block (SMB2) SET_INFO operations. The system incorrectly uses the ksmbd worker's credentials instead of the original user's credentials when performing file system checks, potentially bypassing security restrictions and enabling unauthorized actions.

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to bypass filesystem permission checks during 'delete-on-close' operations. Specifically, when a file handle is torn down, the base-file unlink and extended attribute (xattr) removal operations incorrectly execute with ksmbd worker credentials instead of the original opener's credentials. This can lead to unauthorized deletion of files or removal of extended attributes, potentially compromising data integrity and availability.

A flaw was found in ksmbd, the in-kernel Server Message Block (SMB) daemon. This vulnerability allows a remote attacker to bypass security restrictions by incorrectly handling credentials for Alternate Data Streams (ADS) input/output (I/O) operations. Instead of using the credentials established when the SMB handle was opened, ksmbd uses the current task's credentials. This misconfiguration can lead to a bypass of inode permissions and Linux Security Module (LSM) policies, potentially resulting in privilege escalation and unauthorized access to system resources.

A flaw was found in the Linux kernel's ksmbd component, which provides Server Message Block (SMB) protocol support. This vulnerability involves incorrect management of byte-range locks when multiple connections are used with SMB3 multichannel. An attacker could exploit this by sending specially crafted SMB requests, potentially causing memory corruption. This could lead to system instability or a denial of service (DoS), making the system unavailable.

A flaw was found in the Linux kernel's ksmbd component. A remote attacker could exploit a vulnerability in the NTLMv2 authentication process to modify a session key even when authentication fails. This bypasses security checks and could potentially lead to unauthorized access or session hijacking.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When mounting filesystems using SMB3 POSIX Extensions, modifications to file ownership (chown) and group (chgrp) were not correctly applied on the server unless specific mount options were also enabled. This could allow a local user to set incorrect file permissions, potentially leading to unauthorized access to sensitive information or unintended privilege escalation.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption, leading to a denial of service or, in some cases, arbitrary code execution.

No description is available for this CVE.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability occurs due to a double-free error when handling change notify replies. If a response attempt returns a replayable error and frees its buffer, and then SMB2_notify_init() fails, the same buffer can be freed again. This can lead to memory corruption and potentially a denial of service.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This vulnerability, a double-free error within the `SMB2_flush()` replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush response, potentially leading to memory corruption. This could result in a denial of service or, in some scenarios, arbitrary code execution.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A double-free vulnerability exists in the `SMB2_open()` replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same buffer again. This memory corruption vulnerability could potentially lead to a denial of service or, in some cases, arbitrary code execution.

A flaw was found in the SMB client of the Linux kernel. A remote attacker could exploit a memory leak in the `receive_encrypted_standard()` function by sending specially crafted compound Protocol Data Units (PDUs). This vulnerability occurs because a buffer is allocated before a necessary size check, leading to the buffer not being freed if the check fails. Repeated exploitation of this flaw could lead to a Denial of Service (DoS) due to memory exhaustion.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. The vulnerability exists in the `posix_info_sid_size()` function, which is responsible for parsing POSIX Security Identifiers (SIDs). An insufficient boundary check allows the system to accept truncated POSIX SIDs, which could lead to unexpected behavior or a denial of service. This issue has been resolved by requiring at least two bytes before reading the subauthority count, ensuring that all client paths safely reject malformed SIDs.

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. To remediate this issue, users should upgrade to version v3.0.1

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When processing server-provided file mode information, the system incorrectly applies these modes without proper security masking. This can result in unintended file permissions, potentially allowing unauthorized access to files or directories.

A flaw was found in the Linux kernel. A race condition exists between the `cgroup_writeback_umount()` and `inode_switch_wbs()` functions when a container exits. This race can lead to a kernel panic, resulting in a denial of service. This vulnerability could be triggered by a local user by exiting a container.

A flaw was found in the Linux kernel's `qcom-cpufreq-hw` driver. This vulnerability, a double free, occurs due to incorrect memory handling when a device is detached. Specifically, the system attempts to release memory that is already managed, leading to a potential double free. This can result in system instability, memory corruption, or a denial of service (DoS), making the system unavailable to legitimate users.