In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request smb2_get_msg()
in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if SMB2_TREE_CONNECT_HE
is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | linux | < 6.1.55-1 | linux_6.1.55-1_all.deb |
Debian | 11 | all | linux | < 5.10.209-2 | linux_5.10.209-2_all.deb |
Debian | 10 | all | linux | < 4.19.249-2 | linux_4.19.249-2_all.deb |
Debian | 999 | all | linux | < 6.5.3-1 | linux_6.5.3-1_all.deb |
Debian | 13 | all | linux | < 6.5.3-1 | linux_6.5.3-1_all.deb |