A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Nov 18, 2024 | Nov 18, 2024 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-bluefieldUpgrade linuxUpgrade linux-nvidia-tegra-5.15Upgrade linux-raspiUpgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-lowlatency-hwe-5.15Upgrade linux-riscv-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-azure-5.15Upgrade linux-kvmUpgrade linux-intel-iot-realtimeUpgrade linux-nvidiaUpgrade linux-intel-iotg-5.15Upgrade linux-aws-fipsUpgrade linux-oracleUpgrade linux-xilinx-zynqmpUpgrade linux-intel-iotgUpgrade linux-oracle-5.15Upgrade linux-fipsUpgrade linux-gkeopUpgrade linux-azure-fdeUpgrade linux-azureUpgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-ibm-5.15Upgrade linux-gkeop-5.15Upgrade linux-gcpUpgrade linux-ibmUpgrade linux-gcp-fipsUpgrade linux-azure-fde-5.15Upgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-hwe-5.15 | Nov 19, 2024 | Nov 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub