CVE-2010-2248: Input Validation
Description of problem: While chasing a bug report involving a OS/2 server, I noticed the server sets pSMBr->CountHigh to a incorrect value even in case of normal writes. This results in 'nbytes' being computed wrongly and triggers a kernel BUG at mm/filemap.c. void ioviteradvance(struct ioviter i, sizet bytes) { BUGON(i->count < bytes); <--- BUG here Why the server is setting 'CountHigh' is not clear but only does so after writing 64k bytes. Though this looks like the server bug, the client side crash may not be acceptable. The workaround is to mask off high 16 bits if the number of bytes written as returned by the server is greater than the bytes requested by the client.
Upstream commit: http://git.kernel.org/linus/6513a81e9325d712f1bfb9a1d7b750134e49ff18 (v2.6.34-rc4)
Other sources
fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2248?
CVE-2010-2248 has been assigned a medium severity level due to potential system instability.
How do I fix CVE-2010-2248?
To fix CVE-2010-2248, update your Linux kernel to version 2.6.34 or later.
What systems are affected by CVE-2010-2248?
CVE-2010-2248 affects multiple versions of the Linux kernel, specifically versions from 2.6.0 to 2.6.34 inclusive.
What type of vulnerability is CVE-2010-2248?
CVE-2010-2248 is a kernel bug that can lead to improper memory management and potential system crashes.
Is there a workaround for CVE-2010-2248?
While the best solution is to update the kernel, temporarily avoiding heavy write operations may mitigate immediate impacts.