ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before d8c450ad0d08980b39b08d435efa921086c8b227 | affected |
| e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 03bb4338c3a7c3fc4decf699a35753f0891aab2a | affected |
| e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 5.15 | affected |
| 0 to before 5.15 | unaffected |
| 6.18.59 through 6.18.* (inclusive) | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared.
ksmbd does not implement quota tracking, so report no control flags.