Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
Product status
7449d736bbbd160c76b01b8fcdf72f58a8757d4b (git) before dffb44b2e06a2908e249f0f93156fc987eee1d1c
ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before 9b3af35645ff9cd334edc130249f9a2fb2bea25f
ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before 512d33bc8ea4ea5c19728ee118715f4b1f4d1926
ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c
ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before 8d09328dfda089675e4c049f3f256064a1d1996b
6.6.32 (semver) before 6.6.140
6.9
Any version before 6.9
6.6.140 (semver)
6.12.88 (semver)
6.18.30 (semver)
7.0.7 (semver)
7.1-rc3 (original_commit_for_fix)
References
git.kernel.org/...c/dffb44b2e06a2908e249f0f93156fc987eee1d1c
git.kernel.org/...c/9b3af35645ff9cd334edc130249f9a2fb2bea25f
git.kernel.org/...c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926
git.kernel.org/...c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c
git.kernel.org/...c/8d09328dfda089675e4c049f3f256064a1d1996b