mbox series

[SRU,Focal,Jammy,OEM-6.1,Lunar,Mantic,0/1] CVE-2023-6606

Message ID 20240103121241.1723794-1-cascardo@canonical.com
Headers show
Series CVE-2023-6606 | expand

Message

Thadeu Lima de Souza Cascardo Jan. 3, 2024, 12:12 p.m. UTC 
[Impact]
An out-of-bounds access in cifs filesystem may lead to crashes or
information leak.

[Test case]
A PoC from the kernel.org bugzilla was used and a different error message
was present in dmesg as expected:

[  518.358312] CIFS: VFS: checkSMB: can't read BCC due to invalid WordCount(240)

[Backport]
Clean cherry-pick on all kernels. For 5.15 and earlier kernels, the file
has been moved, hence the second patch version.

[Potential regression]
Failure to mount cifs or filesystem corruption on cifs mounts.

Paulo Alcantara (1):
  smb: client: fix OOB in smbCalcSize()

 fs/smb/client/misc.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Manuel Diewald Jan. 3, 2024, 12:53 p.m. UTC | #1 
On Wed, Jan 03, 2024 at 09:12:39AM -0300, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> An out-of-bounds access in cifs filesystem may lead to crashes or
> information leak.
> 
> [Test case]
> A PoC from the kernel.org bugzilla was used and a different error message
> was present in dmesg as expected:
> 
> [  518.358312] CIFS: VFS: checkSMB: can't read BCC due to invalid WordCount(240)
> 
> [Backport]
> Clean cherry-pick on all kernels. For 5.15 and earlier kernels, the file
> has been moved, hence the second patch version.
> 
> [Potential regression]
> Failure to mount cifs or filesystem corruption on cifs mounts.
> 
> Paulo Alcantara (1):
>   smb: client: fix OOB in smbCalcSize()
> 
>  fs/smb/client/misc.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> -- 
> 2.34.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Manuel Diewald <manuel.diewald@canonical.com>
Jacob Martin Jan. 3, 2024, 2:17 p.m. UTC | #2 
Acked-by: Jacob Martin <jacob.martin@canonical.com>

On 1/3/24 6:12 AM, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> An out-of-bounds access in cifs filesystem may lead to crashes or
> information leak.
>
> [Test case]
> A PoC from the kernel.org bugzilla was used and a different error message
> was present in dmesg as expected:
>
> [  518.358312] CIFS: VFS: checkSMB: can't read BCC due to invalid WordCount(240)
>
> [Backport]
> Clean cherry-pick on all kernels. For 5.15 and earlier kernels, the file
> has been moved, hence the second patch version.
>
> [Potential regression]
> Failure to mount cifs or filesystem corruption on cifs mounts.
>
> Paulo Alcantara (1):
>    smb: client: fix OOB in smbCalcSize()
>
>   fs/smb/client/misc.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
Roxana Nicolescu Jan. 4, 2024, 3:52 p.m. UTC | #3 
On 03/01/2024 13:12, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> An out-of-bounds access in cifs filesystem may lead to crashes or
> information leak.
>
> [Test case]
> A PoC from the kernel.org bugzilla was used and a different error message
> was present in dmesg as expected:
>
> [  518.358312] CIFS: VFS: checkSMB: can't read BCC due to invalid WordCount(240)
>
> [Backport]
> Clean cherry-pick on all kernels. For 5.15 and earlier kernels, the file
> has been moved, hence the second patch version.
>
> [Potential regression]
> Failure to mount cifs or filesystem corruption on cifs mounts.
>
> Paulo Alcantara (1):
>    smb: client: fix OOB in smbCalcSize()
>
>   fs/smb/client/misc.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
Applied to mantic, lunar, jammy, focal master-next branches. Thanks!
Timo Aaltonen Jan. 8, 2024, 1:47 p.m. UTC | #4 
Thadeu Lima de Souza Cascardo kirjoitti 3.1.2024 klo 14.12:
> [Impact]
> An out-of-bounds access in cifs filesystem may lead to crashes or
> information leak.
> 
> [Test case]
> A PoC from the kernel.org bugzilla was used and a different error message
> was present in dmesg as expected:
> 
> [  518.358312] CIFS: VFS: checkSMB: can't read BCC due to invalid WordCount(240)
> 
> [Backport]
> Clean cherry-pick on all kernels. For 5.15 and earlier kernels, the file
> has been moved, hence the second patch version.
> 
> [Potential regression]
> Failure to mount cifs or filesystem corruption on cifs mounts.
> 
> Paulo Alcantara (1):
>    smb: client: fix OOB in smbCalcSize()
> 
>   fs/smb/client/misc.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 

applied to oem-6.1-prep, thanks