Bug 2258518 (CVE-2024-0565) - CVE-2024-0565 kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client
Summary: CVE-2024-0565 kernel: CIFS Filesystem Decryption Improper Input Validation Re...
Keywords:
Status: NEW
Alias: CVE-2024-0565
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2258517
TreeView+ depends on / blocked
 
Reported: 2024-01-15 19:20 UTC by Rohit Keshri
Modified: 2024-05-02 22:50 UTC (History)
46 users (show)

Fixed In Version: Kernel 6.7-rc6
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:1699 0 None None None 2024-04-08 14:54:16 UTC
Red Hat Product Errata RHBA-2024:2634 0 None None None 2024-05-01 01:22:24 UTC
Red Hat Product Errata RHBA-2024:2650 0 None None None 2024-05-02 00:15:11 UTC
Red Hat Product Errata RHBA-2024:2686 0 None None None 2024-05-02 22:50:18 UTC
Red Hat Product Errata RHSA-2024:1188 0 None None None 2024-03-06 12:37:38 UTC
Red Hat Product Errata RHSA-2024:1404 0 None None None 2024-03-19 17:27:58 UTC
Red Hat Product Errata RHSA-2024:1532 0 None None None 2024-03-27 00:18:37 UTC
Red Hat Product Errata RHSA-2024:1533 0 None None None 2024-03-27 00:11:49 UTC
Red Hat Product Errata RHSA-2024:1607 0 None None None 2024-04-02 15:55:42 UTC
Red Hat Product Errata RHSA-2024:1614 0 None None None 2024-04-02 17:21:54 UTC
Red Hat Product Errata RHSA-2024:2394 0 None None None 2024-04-30 10:15:09 UTC

Description Rohit Keshri 2024-01-15 19:20:38 UTC 
Linux Kernel CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability.

This case affected the cifs.ko, which is linux CIFS file system module, the client side of the CIFS didn't validate the `NextCommand` field, which is controlled from server side, it leads to DoS (due to OOB read on the memcpy source buffer) and wild copy (due to integer underflow on the memcpy length), both results are caused by the `NextCommand` without validation, that's why they merged into same case

Reference;
https://www.spinics.net/lists/stable-commits/msg328851.html
Comment 14 errata-xmlrpc 2024-03-06 12:37:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:1188 https://access.redhat.com/errata/RHSA-2024:1188
Comment 16 errata-xmlrpc 2024-03-19 17:27:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404
Comment 17 errata-xmlrpc 2024-03-27 00:11:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:1533 https://access.redhat.com/errata/RHSA-2024:1533
Comment 18 errata-xmlrpc 2024-03-27 00:18:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:1532 https://access.redhat.com/errata/RHSA-2024:1532
Comment 19 errata-xmlrpc 2024-04-02 15:55:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1607 https://access.redhat.com/errata/RHSA-2024:1607
Comment 20 errata-xmlrpc 2024-04-02 17:21:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1614 https://access.redhat.com/errata/RHSA-2024:1614
Comment 23 errata-xmlrpc 2024-04-30 10:15:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394
Note You need to log in before you can comment on or make changes to this bug.