NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-787

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.0 up to (excluding) 5.4.285
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.229
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.170
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.115
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.59
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.6
     *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*

https://git.kernel.org/stable/c/1ab60323c5201bef25f2a3dc0ccc404d9aca77f1 No Types Assigned

https://git.kernel.org/stable/c/1ab60323c5201bef25f2a3dc0ccc404d9aca77f1 Patch

https://git.kernel.org/stable/c/2ef632bfb888d1a14f81c1703817951e0bec5531 No Types Assigned

https://git.kernel.org/stable/c/2ef632bfb888d1a14f81c1703817951e0bec5531 Patch

https://git.kernel.org/stable/c/6f0516ef1290da24b85461ed08a0938af7415e49 No Types Assigned

https://git.kernel.org/stable/c/6f0516ef1290da24b85461ed08a0938af7415e49 Patch

https://git.kernel.org/stable/c/b209c3a0bc3ac172265c7fa8309e5d00654f2510 No Types Assigned

https://git.kernel.org/stable/c/b209c3a0bc3ac172265c7fa8309e5d00654f2510 Patch

https://git.kernel.org/stable/c/e07d05b7f5ad9a503d9cab0afde2ab867bb65470 No Types Assigned

https://git.kernel.org/stable/c/e07d05b7f5ad9a503d9cab0afde2ab867bb65470 Patch

https://git.kernel.org/stable/c/ed31aba8ce93472d9e16f5cff844ae7c94e9601d No Types Assigned

https://git.kernel.org/stable/c/ed31aba8ce93472d9e16f5cff844ae7c94e9601d Patch

https://git.kernel.org/stable/c/fe92ddc1c32d4474e605e3a31a4afcd0e7d765ec No Types Assigned

https://git.kernel.org/stable/c/fe92ddc1c32d4474e605e3a31a4afcd0e7d765ec Patch

kernel.org https://git.kernel.org/stable/c/6f0516ef1290da24b85461ed08a0938af7415e49 [No types assigned]

kernel.org https://git.kernel.org/stable/c/ed31aba8ce93472d9e16f5cff844ae7c94e9601d [No types assigned]

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOBs when building SMB2_IOCTL request

When using encryption, either enforced by the server or when using
'seal' mount option, the client will squash all compound request buffers
down for encryption into a single iov in smb2_set_next_command().

SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the
SMB2_IOCTL request in the first iov, and if the user passes an input
buffer that is greater than 328 bytes, smb2_set_next_command() will
end up writing off the end of @rqst->iov[0].iov_base as shown below:

  mount.cifs //srv/share /mnt -o ...,seal
  ln -s $(perl -e "print('a')for 1..1024") /mnt/link

  BUG: KASAN: slab-out-of-bounds in
  smb2_set_next_command.cold+0x1d6/0x24c [cifs]
  Write of size 4116 at addr ffff8881148fcab8 by task ln/859

  CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  1.16.3-2.fc40 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x5d/0x80
   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
   print_report+0x156/0x4d9
   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
   ? __virt_addr_valid+0x145/0x310
   ? __phys_addr+0x46/0x90
   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
   kasan_report+0xda/0x110
   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
   kasan_check_range+0x10f/0x1f0
   __asan_memcpy+0x3c/0x60
   smb2_set_next_command.cold+0x1d6/0x24c [cifs]
   smb2_compound_op+0x238c/0x3840 [cifs]
   ? kasan_save_track+0x14/0x30
   ? kasan_save_free_info+0x3b/0x70
   ? vfs_symlink+0x1a1/0x2c0
   ? do_symlinkat+0x108/0x1c0
   ? __pfx_smb2_compound_op+0x10/0x10 [cifs]
   ? kmem_cache_free+0x118/0x3e0
   ? cifs_get_writable_path+0xeb/0x1a0 [cifs]
   smb2_get_reparse_inode+0x423/0x540 [cifs]
   ? __pfx_smb2_get_reparse_inode+0x10/0x10 [cifs]
   ? rcu_is_watching+0x20/0x50
   ? __kmalloc_noprof+0x37c/0x480
   ? smb2_create_reparse_symlink+0x257/0x490 [cifs]
   ? smb2_create_reparse_symlink+0x38f/0x490 [cifs]
   smb2_create_

kernel.org https://git.kernel.org/stable/c/1ab60323c5201bef25f2a3dc0ccc404d9aca77f1 [No types assigned]

kernel.org https://git.kernel.org/stable/c/2ef632bfb888d1a14f81c1703817951e0bec5531 [No types assigned]

kernel.org https://git.kernel.org/stable/c/b209c3a0bc3ac172265c7fa8309e5d00654f2510 [No types assigned]

kernel.org https://git.kernel.org/stable/c/e07d05b7f5ad9a503d9cab0afde2ab867bb65470 [No types assigned]

kernel.org https://git.kernel.org/stable/c/fe92ddc1c32d4474e605e3a31a4afcd0e7d765ec [No types assigned]