cve-2024-26692
Vulnerability from cvelistv5
Published
2024-04-03 14:54
Modified
2024-09-11 17:33
Severity
Summary
smb: Fix regression in writes when non-standard maximum write size negotiated
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26692",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:00.719188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:31.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c",
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4145ccff546e",
              "status": "affected",
              "version": "d08089f649a0",
              "versionType": "git"
            },
            {
              "lessThan": "63c35afd50e2",
              "status": "affected",
              "version": "d08089f649a0",
              "versionType": "git"
            },
            {
              "lessThan": "4860abb91f3d",
              "status": "affected",
              "version": "d08089f649a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c",
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Fix regression in writes when non-standard maximum write size negotiated\n\nThe conversion to netfs in the 6.3 kernel caused a regression when\nmaximum write size is set by the server to an unexpected value which is\nnot a multiple of 4096 (similarly if the user overrides the maximum\nwrite size by setting mount parm \"wsize\", but sets it to a value that\nis not a multiple of 4096).  When negotiated write size is not a\nmultiple of 4096 the netfs code can skip the end of the final\npage when doing large sequential writes, causing data corruption.\n\nThis section of code is being rewritten/removed due to a large\nnetfs change, but until that point (ie for the 6.3 kernel until now)\nwe can not support non-standard maximum write sizes.\n\nAdd a warning if a user specifies a wsize on mount that is not\na multiple of 4096 (and round down), also add a change where we\nround down the maximum write size if the server negotiates a value\nthat is not a multiple of 4096 (we also have to check to make sure that\nwe do not round it down to zero)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:20:59.118Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
        }
      ],
      "title": "smb: Fix regression in writes when non-standard maximum write size negotiated",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26692",
    "datePublished": "2024-04-03T14:54:53.343Z",
    "dateReserved": "2024-02-19T14:20:24.155Z",
    "dateUpdated": "2024-09-11T17:33:31.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26692\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T15:15:52.610\",\"lastModified\":\"2024-04-03T17:24:18.150\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: Fix regression in writes when non-standard maximum write size negotiated\\n\\nThe conversion to netfs in the 6.3 kernel caused a regression when\\nmaximum write size is set by the server to an unexpected value which is\\nnot a multiple of 4096 (similarly if the user overrides the maximum\\nwrite size by setting mount parm \\\"wsize\\\", but sets it to a value that\\nis not a multiple of 4096).  When negotiated write size is not a\\nmultiple of 4096 the netfs code can skip the end of the final\\npage when doing large sequential writes, causing data corruption.\\n\\nThis section of code is being rewritten/removed due to a large\\nnetfs change, but until that point (ie for the 6.3 kernel until now)\\nwe can not support non-standard maximum write sizes.\\n\\nAdd a warning if a user specifies a wsize on mount that is not\\na multiple of 4096 (and round down), also add a change where we\\nround down the maximum write size if the server negotiates a value\\nthat is not a multiple of 4096 (we also have to check to make sure that\\nwe do not round it down to zero).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb: se corrigi\u00f3 la regresi\u00f3n en las escrituras cuando se negoci\u00f3 un tama\u00f1o de escritura m\u00e1ximo no est\u00e1ndar. La conversi\u00f3n a netfs en el kernel 6.3 provoc\u00f3 una regresi\u00f3n cuando el servidor estableci\u00f3 el tama\u00f1o de escritura m\u00e1ximo en un valor inesperado. que no es un m\u00faltiplo de 4096 (de manera similar, si el usuario anula el tama\u00f1o m\u00e1ximo de escritura configurando el par\u00e1metro de montaje \\\"wsize\\\", pero lo establece en un valor que no es un m\u00faltiplo de 4096). Cuando el tama\u00f1o de escritura negociado no es un m\u00faltiplo de 4096, el c\u00f3digo netfs puede omitir el final de la p\u00e1gina final al realizar escrituras secuenciales grandes, lo que provoca corrupci\u00f3n de datos. Esta secci\u00f3n de c\u00f3digo se est\u00e1 reescribiendo/eliminando debido a un gran cambio en netfs, pero hasta ese momento (es decir, para el kernel 6.3 hasta ahora) no podemos admitir tama\u00f1os m\u00e1ximos de escritura no est\u00e1ndar. Agregue una advertencia si un usuario especifica un wsize en el montaje que no es un m\u00faltiplo de 4096 (y redondea hacia abajo), tambi\u00e9n agregue un cambio donde redondeamos hacia abajo el tama\u00f1o m\u00e1ximo de escritura si el servidor negocia un valor que no es un m\u00faltiplo de 4096 ( tambi\u00e9n tenemos que comprobar que no lo redondeamos a cero).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.