cve-2024-26692
Vulnerability from cvelistv5
Published
2024-04-03 14:54
Modified
2024-12-19 08:45
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in writes when non-standard maximum write size negotiated The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size is not a multiple of 4096 the netfs code can skip the end of the final page when doing large sequential writes, causing data corruption. This section of code is being rewritten/removed due to a large netfs change, but until that point (ie for the 6.3 kernel until now) we can not support non-standard maximum write sizes. Add a warning if a user specifies a wsize on mount that is not a multiple of 4096 (and round down), also add a change where we round down the maximum write size if the server negotiates a value that is not a multiple of 4096 (we also have to check to make sure that we do not round it down to zero).
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9
Impacted products
Vendor Product Version
Linux Linux Version: 6.3
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26692",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:00.719188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:31.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c",
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4145ccff546ea868428b3e0fe6818c6261b574a9",
              "status": "affected",
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "versionType": "git"
            },
            {
              "lessThan": "63c35afd50e28b49c5b75542045a8c42b696dab9",
              "status": "affected",
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "versionType": "git"
            },
            {
              "lessThan": "4860abb91f3d7fbaf8147d54782149bb1fc45892",
              "status": "affected",
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c",
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Fix regression in writes when non-standard maximum write size negotiated\n\nThe conversion to netfs in the 6.3 kernel caused a regression when\nmaximum write size is set by the server to an unexpected value which is\nnot a multiple of 4096 (similarly if the user overrides the maximum\nwrite size by setting mount parm \"wsize\", but sets it to a value that\nis not a multiple of 4096).  When negotiated write size is not a\nmultiple of 4096 the netfs code can skip the end of the final\npage when doing large sequential writes, causing data corruption.\n\nThis section of code is being rewritten/removed due to a large\nnetfs change, but until that point (ie for the 6.3 kernel until now)\nwe can not support non-standard maximum write sizes.\n\nAdd a warning if a user specifies a wsize on mount that is not\na multiple of 4096 (and round down), also add a change where we\nround down the maximum write size if the server negotiates a value\nthat is not a multiple of 4096 (we also have to check to make sure that\nwe do not round it down to zero)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:45:12.182Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
        }
      ],
      "title": "smb: Fix regression in writes when non-standard maximum write size negotiated",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26692",
    "datePublished": "2024-04-03T14:54:53.343Z",
    "dateReserved": "2024-02-19T14:20:24.155Z",
    "dateUpdated": "2024-12-19T08:45:12.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26692\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T15:15:52.610\",\"lastModified\":\"2024-11-21T09:02:51.487\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: Fix regression in writes when non-standard maximum write size negotiated\\n\\nThe conversion to netfs in the 6.3 kernel caused a regression when\\nmaximum write size is set by the server to an unexpected value which is\\nnot a multiple of 4096 (similarly if the user overrides the maximum\\nwrite size by setting mount parm \\\"wsize\\\", but sets it to a value that\\nis not a multiple of 4096).  When negotiated write size is not a\\nmultiple of 4096 the netfs code can skip the end of the final\\npage when doing large sequential writes, causing data corruption.\\n\\nThis section of code is being rewritten/removed due to a large\\nnetfs change, but until that point (ie for the 6.3 kernel until now)\\nwe can not support non-standard maximum write sizes.\\n\\nAdd a warning if a user specifies a wsize on mount that is not\\na multiple of 4096 (and round down), also add a change where we\\nround down the maximum write size if the server negotiates a value\\nthat is not a multiple of 4096 (we also have to check to make sure that\\nwe do not round it down to zero).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb: se corrigi\u00f3 la regresi\u00f3n en las escrituras cuando se negoci\u00f3 un tama\u00f1o de escritura m\u00e1ximo no est\u00e1ndar. La conversi\u00f3n a netfs en el kernel 6.3 provoc\u00f3 una regresi\u00f3n cuando el servidor estableci\u00f3 el tama\u00f1o de escritura m\u00e1ximo en un valor inesperado. que no es un m\u00faltiplo de 4096 (de manera similar, si el usuario anula el tama\u00f1o m\u00e1ximo de escritura configurando el par\u00e1metro de montaje \\\"wsize\\\", pero lo establece en un valor que no es un m\u00faltiplo de 4096). Cuando el tama\u00f1o de escritura negociado no es un m\u00faltiplo de 4096, el c\u00f3digo netfs puede omitir el final de la p\u00e1gina final al realizar escrituras secuenciales grandes, lo que provoca corrupci\u00f3n de datos. Esta secci\u00f3n de c\u00f3digo se est\u00e1 reescribiendo/eliminando debido a un gran cambio en netfs, pero hasta ese momento (es decir, para el kernel 6.3 hasta ahora) no podemos admitir tama\u00f1os m\u00e1ximos de escritura no est\u00e1ndar. Agregue una advertencia si un usuario especifica un wsize en el montaje que no es un m\u00faltiplo de 4096 (y redondea hacia abajo), tambi\u00e9n agregue un cambio donde redondeamos hacia abajo el tama\u00f1o m\u00e1ximo de escritura si el servidor negocia un valor que no es un m\u00faltiplo de 4096 ( tambi\u00e9n tenemos que comprobar que no lo redondeamos a cero).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.