An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfrom_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.
[
{
"deprecated": false,
"target": {
"file": "fs/smb/server/smb2misc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d10c77873ba1e9e6b91905018e29e196fd5f863d",
"digest": {
"line_hashes": [
"43771237337176510340694325053796229256",
"29228488974346550091578634992390604381",
"41023294579347148805596549137184752768",
"33500679165540305442948757906132828968",
"309453067381208191529333110809565422530",
"35749775586440092551781261438517737464",
"112124155980369682830439430057294814606",
"78219771098533524049911725388133235415",
"25497819103735861367690580326977055022",
"215866521700659445302672334631450514001",
"258201480260752747447905738536936918671",
"233648347296466633034407201026544520442",
"64038606573950446557033787943625646882"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-22705-58949716"
},
{
"deprecated": false,
"target": {
"function": "smb2_get_data_area_len",
"file": "fs/smb/server/smb2misc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d10c77873ba1e9e6b91905018e29e196fd5f863d",
"digest": {
"function_hash": "220265825819379200896244077630266600579",
"length": 2708.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-22705-94165ce2"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-22705.json"