CVE-2024-26954 — Out-of-bounds Read in Linux
Severity
7.1HIGHNVD
OSV5.5
EPSS
0.0%
top 99.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 1
Latest updateJul 4
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
If ->NameOffset of smb2_create_req is smaller than Buffer offset of
smb2_create_req, slab-out-of-bounds read can happen from smb2_open.
This patch set the minimum value of the name offset to the buffer offset
to validate name length of smb2_create_req().
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
▶CVEListV5linux/linux0626e6641f6b467447c81dd7678a69c66f7746cf — d70c2e0904ab3715c5673fd45788a464a246d1db+5
Patches
🔴Vulnerability Details
7📋Vendor Advisories
7💬Community
1Bugzilla
▶