Linux kernel (ksmbd) vulnerabilities

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.

In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.

An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.

A vulnerability has been identified in the Linux kernel that allowed for out-of-bounds writes when processing compound requests in ksmbd. The issue occurred when the first command in a request consumed most of the response buffer, leading to errors in building the security descriptor.