Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix buffer overflow when parsing NFS reparse points

ReparseDataLength is sum of the InodeType size and DataBuffer size.
So to get DataBuffer size it is needed to subtract InodeType's size from
ReparseDataLength.

Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer
at position after the end of the buffer because it does not subtract
InodeType size from the length. Fix this problem and correctly subtract
variable len.

Member InodeType is present only when reparse buffer is large enough. Check
for ReparseDataLength before accessing InodeType to prevent another invalid
memory access.

Major and minor rdev values are present also only when reparse buffer is
large enough. Check for reparse buffer size before calling reparse_mkdev().

Classification

CVE ID: CVE-2024-49996

Affected Products

Vendor: Linux

Product: Linux

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 5.08% (scored less or equal to compared to others)

EPSS Date: 2025-02-04 (when was this score calculated)

References

https://git.kernel.org/stable/c/7b222d6cb87077faf56a687a72af1951cf78c8a9
https://git.kernel.org/stable/c/73b078e3314d4854fd8286f3ba65c860ddd3a3dd
https://git.kernel.org/stable/c/01cdddde39b065074fd48f07027757783cbf5b7d
https://git.kernel.org/stable/c/ec79e6170bcae8a6036a4b6960f5e7e59a785601
https://git.kernel.org/stable/c/c6db81c550cea0c73bd72ef55f579991e0e4ba07
https://git.kernel.org/stable/c/803b3a39cb096d8718c0aebc03fd19f11c7dc919
https://git.kernel.org/stable/c/c173d47b69f07cd7ca08efb4e458adbd4725d8e9
https://git.kernel.org/stable/c/e2a8910af01653c1c268984855629d71fb81f404

Timeline