In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()<\/p>\n
The SMB1 synchronous read helper CIFSSMBRead() validates the server’s
\nDataLength against CIFSMaxBufSize and the caller’s count, but never
\nvalidates DataOffset. The copy source is formed as<\/p>\n
\t&pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset)<\/p>\n
and memcpy()’d for DataLength bytes with no check that the
\n[DataOffset, DataOffset + DataLength) range lies within the response
\nactually received from the server.<\/p>\n
A malicious or compromised SMB1 server can return a response carrying
\nan in-range DataLength and a large DataOffset, driving the source
\npointer past the end of the response buffer. The memcpy() then copies
\nadjacent kernel heap into the caller’s read buffer (information
\ndisclosure), or reads unmapped memory and oopses (denial of service).
\nSMB1 is not negotiated by default; reaching this code requires an
\nexplicit vers=1.0 mount.<\/p>\n
Both DataOffset and the received response length recorded in
\nrsp_iov.iov_len are relative to the start of the SMB header, so reject
\nthe response unless DataOffset + DataLength fits within that length,
\nusing overflow-safe arithmetic, before forming the source pointer.
\nThe response length has been validated by the previous patch, so the
\nDataOffset and DataLength fields can be read safely here.<\/p>\n
While here, make data_length unsigned. It holds a length derived from
\nunsigned on-the-wire fields and is only ever compared against unsigned
\nquantities; print it with %u accordingly, and add __func__ to the
\ncifs_dbg() calls in this function.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()<\/p>\n
The SMB1 synchronous read helper CIFSSMBRead() validates the server’<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28995","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}