Linux Kernel ksmbd Incorrect Validation Vulnerability in SMB ACL Processing

A vulnerability has been identified in the Linux kernel's ksmbd component, specifically related to the validation of the num_aces field in the smb_aclparse_dcal() function. The issue arises because the validation allows for the creation of an array size up to ULONG_MAX, which is incorrect. The smb_acl structure includes a size field that should be used to accurately calculate the number of access control entries (ACEs) in the request buffer. This vulnerability could potentially be exploited to allocate an excessively large array, leading to memory-related issues.

Impact

Exploitation of this vulnerability could result in improper memory allocation, potentially causing memory corruption or other related issues.