In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix buffer overflow when parsing NFS reparse points
ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength.
Function cifsstrndupfrom_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len.
Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access.
Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1341.0,
"function_hash": "274095417313459197569327576737951740541"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803b3a39cb096d8718c0aebc03fd19f11c7dc919",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "cifs_reparse_point_to_fattr"
},
"id": "CVE-2024-49996-03051446"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36972891602766573551882086302339936731",
"278066986384965593417883122750029776440",
"233245193809455538303071914790927734650",
"33209552435181120772740139327164182045",
"271615132156317380757117077525723353610",
"48966202593408704773086494879686148988",
"218150032340757688032517695600242254970",
"158467974880642177861204974958568846447",
"270130639657873453060510731846233773557",
"303451824033140726130293020531707812919",
"47040974480128690690082762146820800149",
"263196507845809731051338171348023574505",
"321055370045669579093997336777039364989",
"242160008481516262720911239098070756234",
"40725430928707478760101948649985531849",
"140881608221661211901246164649950750525"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6db81c550cea0c73bd72ef55f579991e0e4ba07",
"target": {
"file": "fs/smb/client/reparse.c"
},
"id": "CVE-2024-49996-0691cf46"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"322010191910039425307711954886206633798",
"101923106393166191874368500319364278185",
"175125705668016528306666253419388182279",
"259578523632281592705112565487258635291"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec79e6170bcae8a6036a4b6960f5e7e59a785601",
"target": {
"file": "fs/smb/client/smb2ops.c"
},
"id": "CVE-2024-49996-06bade36"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1369.0,
"function_hash": "90686002013004181946237765503149531497"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a8910af01653c1c268984855629d71fb81f404",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "cifs_reparse_point_to_fattr"
},
"id": "CVE-2024-49996-111a12c8"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 742.0,
"function_hash": "9656927425627233384488313647112840608"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803b3a39cb096d8718c0aebc03fd19f11c7dc919",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-188b66b1"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1341.0,
"function_hash": "274095417313459197569327576737951740541"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c173d47b69f07cd7ca08efb4e458adbd4725d8e9",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "cifs_reparse_point_to_fattr"
},
"id": "CVE-2024-49996-27a9d5d4"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 742.0,
"function_hash": "9656927425627233384488313647112840608"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a8910af01653c1c268984855629d71fb81f404",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-575a9f15"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"322010191910039425307711954886206633798",
"101923106393166191874368500319364278185",
"175125705668016528306666253419388182279",
"259578523632281592705112565487258635291"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73b078e3314d4854fd8286f3ba65c860ddd3a3dd",
"target": {
"file": "fs/cifs/smb2ops.c"
},
"id": "CVE-2024-49996-64e6280e"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36972891602766573551882086302339936731",
"278066986384965593417883122750029776440",
"233245193809455538303071914790927734650",
"33209552435181120772740139327164182045",
"271615132156317380757117077525723353610",
"48966202593408704773086494879686148988",
"218150032340757688032517695600242254970",
"158467974880642177861204974958568846447",
"270130639657873453060510731846233773557",
"303451824033140726130293020531707812919",
"47040974480128690690082762146820800149",
"263196507845809731051338171348023574505",
"321055370045669579093997336777039364989",
"242160008481516262720911239098070756234",
"40725430928707478760101948649985531849",
"140881608221661211901246164649950750525"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803b3a39cb096d8718c0aebc03fd19f11c7dc919",
"target": {
"file": "fs/smb/client/reparse.c"
},
"id": "CVE-2024-49996-97eb97a4"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 742.0,
"function_hash": "9656927425627233384488313647112840608"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c173d47b69f07cd7ca08efb4e458adbd4725d8e9",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-b65b6485"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 562.0,
"function_hash": "141610767396401703682447494895377768863"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01cdddde39b065074fd48f07027757783cbf5b7d",
"target": {
"file": "fs/cifs/smb2ops.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-b9885418"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1341.0,
"function_hash": "274095417313459197569327576737951740541"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6db81c550cea0c73bd72ef55f579991e0e4ba07",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "cifs_reparse_point_to_fattr"
},
"id": "CVE-2024-49996-bd37c824"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"322010191910039425307711954886206633798",
"101923106393166191874368500319364278185",
"175125705668016528306666253419388182279",
"259578523632281592705112565487258635291"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01cdddde39b065074fd48f07027757783cbf5b7d",
"target": {
"file": "fs/cifs/smb2ops.c"
},
"id": "CVE-2024-49996-bed38a45"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36972891602766573551882086302339936731",
"278066986384965593417883122750029776440",
"233245193809455538303071914790927734650",
"33209552435181120772740139327164182045",
"271615132156317380757117077525723353610",
"48966202593408704773086494879686148988",
"218150032340757688032517695600242254970",
"158467974880642177861204974958568846447",
"270130639657873453060510731846233773557",
"303451824033140726130293020531707812919",
"157431926086693349305318825828366551565",
"238585908840481997604828601332846704840",
"292901181561361669655164492049385253134",
"309350557930367488764210799935939996120",
"283353104503238202542145537478882986038",
"154876353625594149683622155645340180001"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a8910af01653c1c268984855629d71fb81f404",
"target": {
"file": "fs/smb/client/reparse.c"
},
"id": "CVE-2024-49996-c16e4150"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 562.0,
"function_hash": "141610767396401703682447494895377768863"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73b078e3314d4854fd8286f3ba65c860ddd3a3dd",
"target": {
"file": "fs/cifs/smb2ops.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-ce336519"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"36972891602766573551882086302339936731",
"278066986384965593417883122750029776440",
"233245193809455538303071914790927734650",
"33209552435181120772740139327164182045",
"271615132156317380757117077525723353610",
"48966202593408704773086494879686148988",
"218150032340757688032517695600242254970",
"158467974880642177861204974958568846447",
"270130639657873453060510731846233773557",
"303451824033140726130293020531707812919",
"47040974480128690690082762146820800149",
"263196507845809731051338171348023574505",
"321055370045669579093997336777039364989",
"242160008481516262720911239098070756234",
"40725430928707478760101948649985531849",
"140881608221661211901246164649950750525"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c173d47b69f07cd7ca08efb4e458adbd4725d8e9",
"target": {
"file": "fs/smb/client/reparse.c"
},
"id": "CVE-2024-49996-d32e5da9"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 742.0,
"function_hash": "9656927425627233384488313647112840608"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6db81c550cea0c73bd72ef55f579991e0e4ba07",
"target": {
"file": "fs/smb/client/reparse.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-e4b6e087"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 562.0,
"function_hash": "141610767396401703682447494895377768863"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec79e6170bcae8a6036a4b6960f5e7e59a785601",
"target": {
"file": "fs/smb/client/smb2ops.c",
"function": "parse_reparse_posix"
},
"id": "CVE-2024-49996-fbe317fc"
}
]