CVE-2024-56627

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56627
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/27de4295522e9a33e4a3fc72f7b8193df9eebe41 Patch
https://git.kernel.org/stable/c/6bd1bf0e8c42f10a9a9679a4c103a9032d30594d Patch
https://git.kernel.org/stable/c/81eed631935f2c52cdaf6691c6d48e0b06e8ad73 Patch
https://git.kernel.org/stable/c/de4d790dcf53be41736239d7ee63849a16ff5d10 Patch
https://git.kernel.org/stable/c/fc342cf86e2dc4d2edb0fc2ff5e28b6c7845adb9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
History

16 Jan 2025, 16:18

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/27de4295522e9a33e4a3fc72f7b8193df9eebe41 - () https://git.kernel.org/stable/c/27de4295522e9a33e4a3fc72f7b8193df9eebe41 - Patch
References () https://git.kernel.org/stable/c/6bd1bf0e8c42f10a9a9679a4c103a9032d30594d - () https://git.kernel.org/stable/c/6bd1bf0e8c42f10a9a9679a4c103a9032d30594d - Patch
References () https://git.kernel.org/stable/c/81eed631935f2c52cdaf6691c6d48e0b06e8ad73 - () https://git.kernel.org/stable/c/81eed631935f2c52cdaf6691c6d48e0b06e8ad73 - Patch
References () https://git.kernel.org/stable/c/de4d790dcf53be41736239d7ee63849a16ff5d10 - () https://git.kernel.org/stable/c/de4d790dcf53be41736239d7ee63849a16ff5d10 - Patch
References () https://git.kernel.org/stable/c/fc342cf86e2dc4d2edb0fc2ff5e28b6c7845adb9 - () https://git.kernel.org/stable/c/fc342cf86e2dc4d2edb0fc2ff5e28b6c7845adb9 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
CWE CWE-125
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

09 Jan 2025, 16:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/6bd1bf0e8c42f10a9a9679a4c103a9032d30594d -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se ha corregido la lectura fuera de los límites en ksmbd_vfs_stream_read. Un desplazamiento del cliente podría ser un valor negativo, lo que podría provocar una lectura fuera de los límites desde stream_buf. Tenga en cuenta que este problema se produce al configurar 'vfs objects = streams_xattr parameter' en ksmbd.conf.

27 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 15:15

Updated : 2025-01-16 16:18

NVD link : CVE-2024-56627

Mitre link : CVE-2024-56627

CVE.ORG link : CVE-2024-56627

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read