CVE-2024-26952: ksmbd: fix potencial out-of-bounds when buffer offset is invalid
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix potencial out-of-bounds when buffer offset is invalid
I found potencial out-of-bounds when buffer offset fields of a few requests is invalid. This patch set the minimum value of buffer offset field to ->Buffer offset to validate buffer length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26952?
CVE-2024-26952 is classified as a medium-severity vulnerability due to the potential for out-of-bounds access in the Linux kernel's ksmbd module.
How do I fix CVE-2024-26952?
To fix CVE-2024-26952, update your Linux kernel to version 6.7.12 or later, or apply patches from your respective Linux distribution.
Which Linux kernel versions are affected by CVE-2024-26952?
CVE-2024-26952 affects Linux kernel versions prior to 6.7.12 and between 6.8.0 and 6.8.3.
What components are impacted by CVE-2024-26952?
CVE-2024-26952 specifically impacts the ksmbd module within the Linux kernel, related to buffer offset handling.
Is CVE-2024-26952 exploitable in any scenario?
Yes, if exploited, CVE-2024-26952 may allow an attacker to trigger out-of-bounds memory access, potentially leading to denial of service or other impacts.