CVE-2024-56626: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix Out-of-Bounds Write in ksmbdvfsstreamwrite
An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs objects = streamsxattr parameter' in ksmbd.conf.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Do not set 'vfs objects = streams_xattr' in ksmbd.conf, since the described out-of-bounds write occurs when this parameter is set.
ksmbd (ksmbd.conf) vfs objects = streams_xattr
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56626?
CVE-2024-56626 has been classified with a severity level that indicates a potential risk of data corruption or system instability.
How do I fix CVE-2024-56626?
To fix CVE-2024-56626, you should apply the latest patch or update provided by the Linux kernel maintainers.
What systems are affected by CVE-2024-56626?
CVE-2024-56626 affects various versions of the Linux kernel between 5.15 and 6.12.5, including specific release candidates.
What is the nature of the vulnerability in CVE-2024-56626?
CVE-2024-56626 involves an out-of-bounds write vulnerability that may allow an attacker to write data outside the bounds of the allocated buffer.
Is CVE-2024-56626 actively exploited in the wild?
As of now, there is no public information to suggest that CVE-2024-56626 is actively exploited in the wild.