In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds checking and pointer lifecycle issues in
receive_encrypted_standard()’s handling of compound encrypted frames:
– Clear next_buffer after assigning it to server->bigbuf. A stale
next_buffer pointer can lead to a use-after-free on subsequent
error paths.
– Update pdu_length to the decrypted plaintext size (buf_size). Using
the pre-decryption length allows NextCommand to point into stale
ciphertext residue.
– Reject next_cmd values smaller than MID_HEADER_SIZE(server).
– Fix an integer overflow in the upper bound check by verifying
pdu_length – next_cmd < MID_HEADER_SIZE(server), ensuring the
trailing slice is large enough for a header.
