CVE-2024-22705

Se descubrió un problema en ksmbd en el kernel de Linux anterior a 6.6.10. smb2_get_data_area_len en fs/smb/server/smb2misc.c puede causar un acceso fuera de los límites smb_strndup_from_utf16 porque la relación entre los datos de Nombre y los datos de CreateContexts está mal manejada.

Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability. A remote attacker could use this to cause a denial of service or possibly expose sensitive information. Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel, leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service or possibly execute arbitrary code.