Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures that sensitive crypto data is cleared before it is freed...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed the warning from kernelwriteiter 2110.972290 ------------ Cut here ------------ 2110.972301 WARNING: CPU: 3 PID: 735 at fs/readwrite.c:599 kernelwriteiter+0x21b/0x280 This patch does not allow writing to directories...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed the mismatch between the increment and decrement of rcount. rcount is only incremented when there is an oplock break, but the increment and decrement operations are not paired. This can cause rcount to become negativ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: fixed the bug in the trap function of smb2lock. If the lock count is greater than 1, the flags might contain an old value. This issue should be checked using the flags of smb Lock, not those of smb Lock. This could lead...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed a use-after-free in smb2leasebreaknoti The function tcptransport has been moved to ksmbdconnfree. If the ksmbd connection is referenced when the ksmbd server thread terminates, it will not be freed. However,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The use-of-free variable issue in ksmbdfreeworkstruct has been fixed. As a result, the interimentry of ksmbdwork can be deleted after the oplock is released. We no longer need to manage this using a linked list. The interi...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevents renaming with an empty string. A client can send an empty newname string to the ksmbd server. This will cause a kernel error due to dalloc. This patch prevents the error from occurring when attempting to rename a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: A missing return value check bug has been fixed. In the smb2sendinterimresp function, if ksmbdallocworkstruct fails to allocate a node, it returns a NULL pointer to the inwork pointer. This can lead to an illegal memory...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a UAF Use-After-Free issue in closefiletableids. A use-after-free condition may occur if one thread destroys a file via ksmbdclosefd, while another thread holds a reference to that file. The existing checks on...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A memory leak was fixed in the parseleasestate function. The previous patch that added a bounds check for the create lease context introduced a memory leak. When the bounds check fails, the function returns NULL without...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The listfirstentryornull function was used in opinfogetlist. The listfirstentry macro never returns NULL. If the list is empty, it returns an invalid pointer. Use listfirstentryornull to check whether the list is empty...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevents the connection from being released during the oplock break notification. The ksmbdwork object can be freed after the connection is released. The rcount of ksmbdconn is incremented to indicate that the requests are...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Added a bounds check for the durable handle context. A missing bounds check was added for the durable handle context...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A validation check for zero numsubauth is added before accessing subauth. Accessing psid-subauthpsid-numsubauth - 1 without checking whether numsubauth is non-zero can lead to an out-of-bounds read. This patch adds a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of unexpectedly changing the path in ksmbdvfskernpathlocked has been fixed. When ksmbdvfskernpathlocked encounters an error, and it isn’t the last entry, it will exit without restoring the changed path buffer...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Type confusion was fixed due to a race condition when using ipcmsgsendrequest. req-handle is allocated using ksmbdacquireid&ipcida, based on idaalloc. req-handle from ksmbdipcloginrequest and FSCTLPIPETRANSCEIVE ioctl can ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A use-after-free issue was fixed in ksmbdsessionsderegister. In multi-channel mode, a UAF Use-After-Free issue can occur in sessionderegister, when the second channel establishes a session through the connection of the fir...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: corrected the incorrect validation of the numaces field in smbacl. parsedcal now validates numaces to allocate an array of posixacestatearray. If numaces is greater than ULONGMAX / sizeofstruct smbace, it results in an...

The vulnerability of the `ksmbd_vfs_kern_path_locked()` function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ksmbdvfskernpathlocked function in the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Kernel ksmbd Session Setup Null Pointer Dereference Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. The specific flaw exists within the handling of preauth...