REDHAT-BUG-732869
First published: Wed Aug 24 2011(Updated: )
The name_len variable in CIFSFindNext is a signed int that gets set to the resume_name_len in the cifs_search_info. The resume_name_len however is unsigned and for some infolevels is populated directly from a 32 bit value sent by the server. If the server sends a very large value for this, then that value could look negative when converted to a signed int. That would make that value pass the PATH_MAX check later in CIFSFindNext. The name_len would then be used as a length value for a memcpy. It would then be treated as unsigned again, and the memcpy scribbles over a ton of memory. Fix this by making the name_len an unsigned value in CIFSFindNext. <a href="http://www.spinics.net/lists/linux-cifs/msg03950.html">http://www.spinics.net/lists/linux-cifs/msg03950.html</a> Acknowledgements: Red Hat would like to thank Darren Lavender for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux CIFS |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.spinics.net/lists/linux-cifs/msg03950.html
- https://rhn.redhat.com/errata/RHSA-2011-1386.html
- https://rhn.redhat.com/errata/RHSA-2011-1465.html
- https://rhn.redhat.com/errata/RHSA-2012-0010.html
- https://access.redhat.com/support/policy/updates/errata/
- http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commitdiff;h=c32dfffaf59f73bbcf4472141b851a4dc5db2bf0
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=748683
- https://bugzilla.redhat.com/show_bug.cgi?id=732869
Frequently Asked Questions
What is the severity of REDHAT-BUG-732869?
The severity of REDHAT-BUG-732869 is classified as moderate.
How do I fix REDHAT-BUG-732869?
To fix REDHAT-BUG-732869, you need to apply the recommended patches provided in the errata for your affected version of Linux CIFS.
What systems are affected by REDHAT-BUG-732869?
REDHAT-BUG-732869 affects systems running the Linux CIFS client.
What causes REDHAT-BUG-732869?
REDHAT-BUG-732869 is caused by a mismatch between signed and unsigned integer types in the handling of the resume_name_len variable.
Is there a workaround for REDHAT-BUG-732869?
A temporary workaround for REDHAT-BUG-732869 may involve limiting the size of data sent from the server.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-3191
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux cifs