Linux: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
What fixes it
- 03bb4338c3a7c3fc4decf699a35753f0891aab2aLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared.
ksmbd does not implement quota tracking, so report no control flags.
Text from CVE List
Affected versions 8
- Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before d8c450ad0d08980b39b08d435efa921086c8b227CVE List
- Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 03bb4338c3a7c3fc4decf699a35753f0891aab2aCVE List
- Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8eCVE List
- Linuxaffected: 5.15CVE List
- Linuxunaffected: all versions before 5.15CVE List
- Linuxunaffected: 6.18.59 through 6.18.*CVE List
- Linuxunaffected: 7.2.13 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List