CVE-2024-26980: ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix slab-out-of-bounds in smb2allocaterspbuf
If ->ProtocolId is SMB2TRANSFORMPROTONUM, smb2 request size validation could be skipped. if request size is smaller than sizeof(struct smb2queryinforeq), slab-out-of-bounds read can happen in smb2allocaterspbuf(). This patch allocate response buffer after decrypting transform request. smb3decryptreq() will validate transform request size and avoid slab-out-of-bound in smb2allocaterspbuf().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel (ksmbd)to a version that resolves this vulnerability.Patch ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf - Configuration
Ensure smb2 request size validation is performed before allocating the response buffer for SMB2_TRANSFORM_PROTO_NUM requests; allocate the smb2 rsp buffer only after decrypting the transform request and verify request size is not smaller than sizeof(struct smb2_query_info_req) to prevent slab-out-of-bounds in smb2_allocate_rsp_buf().
ksmbd smb2 request size validation for SMB2_TRANSFORM_PROTO_NUM = required
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26980?
CVE-2024-26980 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26980?
To fix CVE-2024-26980, upgrade to the patched versions of the Linux kernel specified in the advisory.
What does CVE-2024-26980 affect?
CVE-2024-26980 affects various versions of the Linux kernel that utilize ksmbd and are vulnerable to slab-out-of-bounds issues.
What are the affected software versions for CVE-2024-26980?
Affected software versions for CVE-2024-26980 include specifically Linux kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, and 6.12.11-1.
What is the impact of CVE-2024-26980?
The impact of CVE-2024-26980 could potentially allow an attacker to bypass request size validation in the ksmbd module, leading to memory corruption.