CVE-2024-56626

HIGH

Linux Kernel 5.15-5.15.175, 5.16-6.1.119, 6.2-6.6.65, 6.7-6.12.4 - Out-of-Bounds Write in ksmbd_vfs_stream_write

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf.

References (6)

Core 6

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

Patch

https://git.kernel.org/stable/c/1aea5c9470be2c7129704fb1b9562b1e3e0576f8

Patch

https://git.kernel.org/stable/c/8cd7490fc0f268883e86e840cda5311257af69ca

Patch

https://git.kernel.org/stable/c/164d3597d26d9acff5d5b8bc3208bdcca942dd6a

Patch

https://git.kernel.org/stable/c/c5797f195c67132d061d29c57a7c6d30530686f0

Patch

https://git.kernel.org/stable/c/313dab082289e460391c82d855430ec8a28ddf81

Scores

CVSS v3 7.8

EPSS 0.0028

EPSS Percentile 19.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-787

Status published

Products (18)

linux/Kernel 5.15.0 - 5.15.176linux

linux/Kernel 5.16.0 - 6.1.120linux

linux/Kernel 6.2.0 - 6.6.66linux

linux/Kernel 6.7.0 - 6.12.5linux

Linux/Linux < 5.15

Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 164d3597d26d9acff5d5b8bc3208bdcca942dd6a

Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 1aea5c9470be2c7129704fb1b9562b1e3e0576f8

Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 313dab082289e460391c82d855430ec8a28ddf81

Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - 8cd7490fc0f268883e86e840cda5311257af69ca

Linux/Linux 0626e6641f6b467447c81dd7678a69c66f7746cf - c5797f195c67132d061d29c57a7c6d30530686f0

... and 8 more

Published Dec 27, 2024

Tracked Since Feb 18, 2026