In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential OOBs in smb2parsecontexts()
Validate offsets and lengths before dereferencing create contexts in smb2parsecontexts().
This fixes following oops when accessing invalid create contexts from server:
BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2parsecontexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? _die+0x23/0x70 ? pagefaultoops+0x181/0x480 ? searchmoduleextables+0x19/0x60 ? srsoaliasreturnthunk+0x5/0xfbef5 ? excpagefault+0x1b6/0x1c0 ? asmexcpagefault+0x26/0x30 ? smb2parsecontexts+0xa0/0x3a0 [cifs] SMB2open+0x38d/0x5f0 [cifs] ? smb2ispathaccessible+0x138/0x260 [cifs] smb2ispathaccessible+0x138/0x260 [cifs] cifsispathremote+0x8d/0x230 [cifs] cifsmount+0x7e/0x350 [cifs] cifssmb3domount+0x128/0x780 [cifs] smb3gettree+0xd9/0x290 [cifs] vfsgettree+0x2c/0x100 ? capable+0x37/0x70 pathmount+0x2d7/0xb80 ? srsoaliasreturnthunk+0x5/0xfbef5 ? rawspinunlockirqrestore+0x44/0x60 _x64sysmount+0x11a/0x150 dosyscall64+0x47/0xf0 entrySYSCALL64after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "229786638823692153573357033540164983068", "48317358246072120181911490813799942611", "60211374289129477893475213505121302743", "270217788978650466137448768889664096905", "176423486673784193102824810142276144903", "26560840208406220484531452711861043807", "309412522485063928422194186869755479652", "237840700928308922880358911932534532599" ] }, "target": { "file": "fs/cifs/smb2proto.h" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "signature_version": "v1", "id": "CVE-2023-52434-0044fdb6", "signature_type": "Line" }, { "digest": { "length": 1332.0, "function_hash": "180957493272412501865545695588733934883" }, "target": { "file": "fs/smb/client/smb2pdu.c", "function": "smb2_parse_contexts" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0f64cc02d4972e21c733d9f21d1c512963afa", "signature_version": "v1", "id": "CVE-2023-52434-1639155a", "signature_type": "Function" }, { "digest": { "length": 1332.0, "function_hash": "180957493272412501865545695588733934883" }, "target": { "file": "fs/smb/client/smb2pdu.c", "function": "smb2_parse_contexts" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "signature_version": "v1", "id": "CVE-2023-52434-28da1bc5", "signature_type": "Function" }, { "digest": { "length": 2415.0, "function_hash": "221416928973623267353763249826065438811" }, "target": { "file": "fs/cifs/smb2pdu.c", "function": "SMB2_open" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890bc4fac3c0973a49cac35f634579bebba7fe48", "signature_version": "v1", "id": "CVE-2023-52434-3899de53", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "202334168497852360150740170330197195586", "316861068372495720865562158680000824129", "330966774017750434920967381828672545153", "131414904148985496910529395757426703702", "225822818798643764565466183036679096654", "163478188184511193609364795206838291774", "57284811881307467661357527168900604310" ] }, "target": { "file": "fs/smb/client/cached_dir.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "signature_version": "v1", "id": "CVE-2023-52434-3fb7a40e", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "136481440451206865550761707778866985110", "206143307270238931833595579043523278899", "230025611291798899880499631100531681074", "273969579735337382833035625841961711851", "314039794793063306776824364406626230163", "164443096393694265583880036046864578529", "269627390861299523652866259370200573494", "14383833280667713413170529862194908668", "89456594781633202420161467500655659749", "321529185093363724521821960031028448828", "154762292933301094334690677784257890512", "291572257157199586951792045025272995729", "18109732351768566264342060132164742148", "130044289669197027626458211978243427842", "206028266271554980804707218107829871782", "238568688556340348614859431638779259372", "37954341075518438635041166375119605703", "46941084094546332062643663185553873602", "185982334123659694610942398620002776657", "34584306367449080960484689472667079490", "272695137573643878152591265628624424061", "275535669758853924380717702493478823615", "319722985489587293569254071766733073058", "269101926750510528602080501727463323160", "201058592040407799111128776414596459789", "149552516608339080869261810995927086216", "306691885348757552132633852072007787713", "223729388010245982354432534342333278592", "339013398387563538410795633024081745756", "24264772836728645576146695873092693593", "110717734498521721153444995535739588816", "140639964342329565840188658540588124427", "264052075736567871072077936555909873601", "298028677409365422463040392229660189574", "206232733699382514493242362707266913762", "161353369536366135935855732730703057859", "29403886593871689507702572332255064546", "232545749278468954145179188637406248365", "179681368659663880586265437388847130049", "73126411778589482842315329852614319919", "332150665211615087312332970837963229402", "44992881812790533632801034731551469505", "210238731713276696242787297249031733698", "165329192352911208487083390101262670754", "339389692064136639010377832527549608107", "196505103385576452245480675380349034947", "70445777300194414826571026760837826355", "16444129603546009856324918532452405259", "71004542080437892755315686571075125318", "128460879117792554383854341905757615220" ] }, "target": { "file": "fs/smb/client/smb2pdu.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0f64cc02d4972e21c733d9f21d1c512963afa", "signature_version": "v1", "id": "CVE-2023-52434-41f75273", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "229786638823692153573357033540164983068", "48317358246072120181911490813799942611", "60211374289129477893475213505121302743", "270217788978650466137448768889664096905", "176423486673784193102824810142276144903", "26560840208406220484531452711861043807", "309412522485063928422194186869755479652", "237840700928308922880358911932534532599" ] }, "target": { "file": "fs/smb/client/smb2proto.h" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "signature_version": "v1", "id": "CVE-2023-52434-43484a9d", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "136481440451206865550761707778866985110", "206143307270238931833595579043523278899", "230025611291798899880499631100531681074", "273969579735337382833035625841961711851", "314039794793063306776824364406626230163", "164443096393694265583880036046864578529", "269627390861299523652866259370200573494", "14383833280667713413170529862194908668", "89456594781633202420161467500655659749", "321529185093363724521821960031028448828", "154762292933301094334690677784257890512", "291572257157199586951792045025272995729", "18109732351768566264342060132164742148", "130044289669197027626458211978243427842", "206028266271554980804707218107829871782", "238568688556340348614859431638779259372", "37954341075518438635041166375119605703", "46941084094546332062643663185553873602", "185982334123659694610942398620002776657", "34584306367449080960484689472667079490", "272695137573643878152591265628624424061", "275535669758853924380717702493478823615", "319722985489587293569254071766733073058", "269101926750510528602080501727463323160", "201058592040407799111128776414596459789", "149552516608339080869261810995927086216", "306691885348757552132633852072007787713", "223729388010245982354432534342333278592", "339013398387563538410795633024081745756", "24264772836728645576146695873092693593", "110717734498521721153444995535739588816", "140639964342329565840188658540588124427", "264052075736567871072077936555909873601", "298028677409365422463040392229660189574", "206232733699382514493242362707266913762", "161353369536366135935855732730703057859", "29403886593871689507702572332255064546", "232545749278468954145179188637406248365", "179681368659663880586265437388847130049", "73126411778589482842315329852614319919", "332150665211615087312332970837963229402", "44992881812790533632801034731551469505", "210238731713276696242787297249031733698", "165329192352911208487083390101262670754", "218222386330537316816474709859719510643", "196505103385576452245480675380349034947", "70445777300194414826571026760837826355", "16444129603546009856324918532452405259", "71004542080437892755315686571075125318", "128460879117792554383854341905757615220" ] }, "target": { "file": "fs/cifs/smb2pdu.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "signature_version": "v1", "id": "CVE-2023-52434-440a0524", "signature_type": "Line" }, { "digest": { "length": 1332.0, "function_hash": "180957493272412501865545695588733934883" }, "target": { "file": "fs/cifs/smb2pdu.c", "function": "smb2_parse_contexts" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "signature_version": "v1", "id": "CVE-2023-52434-46403423", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "136481440451206865550761707778866985110", "206143307270238931833595579043523278899", "230025611291798899880499631100531681074", "273969579735337382833035625841961711851", "314039794793063306776824364406626230163", "164443096393694265583880036046864578529", "269627390861299523652866259370200573494", "14383833280667713413170529862194908668", "89456594781633202420161467500655659749", "321529185093363724521821960031028448828", "154762292933301094334690677784257890512", "291572257157199586951792045025272995729", "18109732351768566264342060132164742148", "130044289669197027626458211978243427842", "206028266271554980804707218107829871782", "238568688556340348614859431638779259372", "37954341075518438635041166375119605703", "46941084094546332062643663185553873602", "185982334123659694610942398620002776657", "34584306367449080960484689472667079490", "272695137573643878152591265628624424061", "275535669758853924380717702493478823615", "319722985489587293569254071766733073058", "269101926750510528602080501727463323160", "201058592040407799111128776414596459789", "149552516608339080869261810995927086216", "306691885348757552132633852072007787713", "223729388010245982354432534342333278592", "339013398387563538410795633024081745756", "24264772836728645576146695873092693593", "110717734498521721153444995535739588816", "140639964342329565840188658540588124427", "264052075736567871072077936555909873601", "298028677409365422463040392229660189574", "206232733699382514493242362707266913762", "161353369536366135935855732730703057859", "29403886593871689507702572332255064546", "232545749278468954145179188637406248365", "179681368659663880586265437388847130049", "73126411778589482842315329852614319919", "332150665211615087312332970837963229402", "44992881812790533632801034731551469505", "210238731713276696242787297249031733698", "165329192352911208487083390101262670754", "218222386330537316816474709859719510643", "196505103385576452245480675380349034947", "70445777300194414826571026760837826355", "16444129603546009856324918532452405259", "71004542080437892755315686571075125318", "128460879117792554383854341905757615220" ] }, "target": { "file": "fs/cifs/smb2pdu.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890bc4fac3c0973a49cac35f634579bebba7fe48", "signature_version": "v1", "id": "CVE-2023-52434-4b55913b", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "136481440451206865550761707778866985110", "206143307270238931833595579043523278899", "230025611291798899880499631100531681074", "273969579735337382833035625841961711851", "314039794793063306776824364406626230163", "164443096393694265583880036046864578529", "269627390861299523652866259370200573494", "14383833280667713413170529862194908668", "89456594781633202420161467500655659749", "321529185093363724521821960031028448828", "154762292933301094334690677784257890512", "291572257157199586951792045025272995729", "18109732351768566264342060132164742148", "130044289669197027626458211978243427842", "206028266271554980804707218107829871782", "238568688556340348614859431638779259372", "37954341075518438635041166375119605703", "46941084094546332062643663185553873602", "185982334123659694610942398620002776657", "34584306367449080960484689472667079490", "272695137573643878152591265628624424061", "275535669758853924380717702493478823615", "319722985489587293569254071766733073058", "269101926750510528602080501727463323160", "201058592040407799111128776414596459789", "149552516608339080869261810995927086216", "306691885348757552132633852072007787713", "223729388010245982354432534342333278592", "339013398387563538410795633024081745756", "24264772836728645576146695873092693593", "110717734498521721153444995535739588816", "140639964342329565840188658540588124427", "264052075736567871072077936555909873601", "298028677409365422463040392229660189574", "206232733699382514493242362707266913762", "161353369536366135935855732730703057859", "29403886593871689507702572332255064546", "232545749278468954145179188637406248365", "179681368659663880586265437388847130049", "73126411778589482842315329852614319919", "332150665211615087312332970837963229402", "44992881812790533632801034731551469505", "210238731713276696242787297249031733698", "165329192352911208487083390101262670754", "218222386330537316816474709859719510643", "196505103385576452245480675380349034947", "70445777300194414826571026760837826355", "16444129603546009856324918532452405259", "71004542080437892755315686571075125318", "128460879117792554383854341905757615220" ] }, "target": { "file": "fs/smb/client/smb2pdu.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "signature_version": "v1", "id": "CVE-2023-52434-642e90ae", "signature_type": "Line" }, { "digest": { "length": 2470.0, "function_hash": "321463214923839154471125824017406004693" }, "target": { "file": "fs/smb/client/smb2pdu.c", "function": "SMB2_open" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "signature_version": "v1", "id": "CVE-2023-52434-71ebe449", "signature_type": "Function" }, { "digest": { "length": 3772.0, "function_hash": "34258130608906246075480651371680866067" }, "target": { "file": "fs/cifs/smb2ops.c", "function": "open_shroot" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "signature_version": "v1", "id": "CVE-2023-52434-8178049a", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "172311250033379694797327010987500673629", "8858570203114331250189759060321314668", "313795754725968009123984759583215704946", "131414904148985496910529395757426703702", "215470430117383740608034671685034447391", "87986623945662331000529158261712638299", "29457268897904965839779528997685973807" ] }, "target": { "file": "fs/cifs/smb2ops.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890bc4fac3c0973a49cac35f634579bebba7fe48", "signature_version": "v1", "id": "CVE-2023-52434-8bb7291b", "signature_type": "Line" }, { "digest": { "length": 2279.0, "function_hash": "94072769800018624948579299504540327277" }, "target": { "file": "fs/cifs/smb2pdu.c", "function": "SMB2_open" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "signature_version": "v1", "id": "CVE-2023-52434-94275476", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "229786638823692153573357033540164983068", "48317358246072120181911490813799942611", "60211374289129477893475213505121302743", "270217788978650466137448768889664096905", "176423486673784193102824810142276144903", "26560840208406220484531452711861043807", "309412522485063928422194186869755479652", "237840700928308922880358911932534532599" ] }, "target": { "file": "fs/cifs/smb2proto.h" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890bc4fac3c0973a49cac35f634579bebba7fe48", "signature_version": "v1", "id": "CVE-2023-52434-a3541df7", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "172311250033379694797327010987500673629", "8858570203114331250189759060321314668", "313795754725968009123984759583215704946", "131414904148985496910529395757426703702", "215470430117383740608034671685034447391", "87986623945662331000529158261712638299", "29457268897904965839779528997685973807" ] }, "target": { "file": "fs/cifs/smb2ops.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13fb0fc4917621f3dfa285a27eaf7151d770b5e5", "signature_version": "v1", "id": "CVE-2023-52434-a9788ca2", "signature_type": "Line" }, { "digest": { "length": 3943.0, "function_hash": "163974146167705240400872494898289001684" }, "target": { "file": "fs/cifs/smb2ops.c", "function": "open_cached_dir" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890bc4fac3c0973a49cac35f634579bebba7fe48", "signature_version": "v1", "id": "CVE-2023-52434-ac202c11", "signature_type": "Function" }, { "digest": { "length": 2470.0, "function_hash": "321463214923839154471125824017406004693" }, "target": { "file": "fs/smb/client/smb2pdu.c", "function": "SMB2_open" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0f64cc02d4972e21c733d9f21d1c512963afa", "signature_version": "v1", "id": "CVE-2023-52434-b51b8524", "signature_type": "Function" }, { "digest": { "length": 4613.0, "function_hash": "121499494187025772027159138031903370530" }, "target": { "file": "fs/smb/client/cached_dir.c", "function": "open_cached_dir" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0f64cc02d4972e21c733d9f21d1c512963afa", "signature_version": "v1", "id": "CVE-2023-52434-bf14ac85", "signature_type": "Function" }, { "digest": { "length": 1332.0, "function_hash": "180957493272412501865545695588733934883" }, "target": { "file": "fs/cifs/smb2pdu.c", "function": "smb2_parse_contexts" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@890bc4fac3c0973a49cac35f634579bebba7fe48", "signature_version": "v1", "id": "CVE-2023-52434-e5ab4d24", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "154212975606626355836407896280612378100", "249332823744305362825488547863998574867", "231517437080718710620072342874534515760", "329191942272464556896959394685081462476", "23255860403420680723034266188248288907", "216675865558177477550642574044670168900", "236667617100573999450646087078504779882", "23969543911034683255913553490917102483", "131414904148985496910529395757426703702", "74577173828880623833601829902269489509", "328235010910575873450459095545522112085", "2254586865471518023918816008356489881" ] }, "target": { "file": "fs/smb/client/cached_dir.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0f64cc02d4972e21c733d9f21d1c512963afa", "signature_version": "v1", "id": "CVE-2023-52434-ed1e2fe6", "signature_type": "Line" }, { "digest": { "length": 4219.0, "function_hash": "41529860494984200162031962259421750106" }, "target": { "file": "fs/smb/client/cached_dir.c", "function": "open_cached_dir" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ae3c59355dc9882e09c020afe8ffbd895ad0f29", "signature_version": "v1", "id": "CVE-2023-52434-eeeca8a0", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "229786638823692153573357033540164983068", "48317358246072120181911490813799942611", "60211374289129477893475213505121302743", "270217788978650466137448768889664096905", "176423486673784193102824810142276144903", "26560840208406220484531452711861043807", "309412522485063928422194186869755479652", "237840700928308922880358911932534532599" ] }, "target": { "file": "fs/smb/client/smb2proto.h" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17a0f64cc02d4972e21c733d9f21d1c512963afa", "signature_version": "v1", "id": "CVE-2023-52434-f4e3cf56", "signature_type": "Line" } ] }