An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Nov 3, 2023 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-102-generic-64kUpgrade linux-image-5.15.0-102-genericUpgrade linux-image-intelUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1054-gkeUpgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1055-gcpUpgrade linux-image-oem-20.04cUpgrade linux-image-azureUpgrade linux-image-5.15.0-1060-azure-fdeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-gkeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-102-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-102-generic-lpaeUpgrade linux-image-5.15.0-1040-gkeopUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1054-kvmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1052-intel-iotgUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1057-awsUpgrade linux-image-oem-20.04bUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1055-oracleUpgrade linux-image-5.15.0-1060-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1048-nvidia-lowlatencyUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatencyUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-102-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1048-nvidiaUpgrade linux-image-5.15.0-1050-ibmUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1050-raspiUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpae | Apr 10, 2024 | Nov 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub