Linux Kernel ksmbd Out-of-Bounds Read Vulnerability in SMB2 Write Handling

A vulnerability in the Linux kernel's ksmbd component allows for an out-of-bounds read during SMB2 write operations. The issue arises because the ksmbd_smb2_check_message function does not properly validate the NextCommand header. If NextCommand exceeds the combined Offset and Length of the SMB2 write, it can lead to an oversized write length, causing the out-of-bounds read.

Impact

Exploitation of this vulnerability causes an out-of-bounds read, which can potentially be exploited to read sensitive information from memory or to cause a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending an SMB2 write request with a NextCommand value that exceeds the allowed length, bypassing the header validation and triggering the out-of-bounds read.

Remediation

Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been patched.