CVE-2024-56627: ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix Out-of-Bounds Read in ksmbdvfsstreamread
An offset from client could be a negative value, It could lead to an out-of-bounds read from the streambuf. Note that this issue is coming when setting 'vfs objects = streamsxattr parameter' in ksmbd.conf.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Do not set 'vfs objects = streams_xattr' in ksmbd.conf, as this configuration is specifically associated with the out-of-bounds read issue (ksmbd_vfs_stream_read).
ksmbd (ksmbd.conf) vfs objects = streams_xattr (remove/avoid)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56627?
CVE-2024-56627 has a medium severity rating due to the potential for an out-of-bounds read in the Linux kernel.
How do I fix CVE-2024-56627?
To fix CVE-2024-56627, you should update your Linux kernel to a version that has addressed the vulnerability.
What versions of the Linux kernel are affected by CVE-2024-56627?
CVE-2024-56627 affects multiple versions of the Linux kernel, specifically from 5.15 to 6.12.5, including certain ranges.
Can CVE-2024-56627 be exploited remotely?
Yes, CVE-2024-56627 could potentially be exploited remotely if an attacker sends a negative offset from a client.
Is there a workaround for CVE-2024-56627?
Currently, the best approach for CVE-2024-56627 is to apply the security updates rather than relying on a workaround.