CVE-2024-26692 smb: Fix regression in writes when non-standard maximum write size negotiated
Data corruption occurs in Linux kernel SMB writes when non-standard write sizes are negotiated or configured, requiring specific mount parameters or server settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-26692?
CVE-2024-26692 is a high-severity vulnerability in Linux kernel, published on 3 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: Fix regression in writes when non-standard maximum write size negotiated
The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size is not a multiple of 4096 the netfs code can skip the end of the final page when doing large sequential writes, causing data corruption.
This section of code is being rewritten/removed due to a large netfs change, but until that point (ie for the 6.3 kernel until now) we can not support non-standard maximum write sizes.
Add a warning if a user specifies a wsize on mount that is not a multiple of 4096 (and round down), also add a change where we round down the maximum write size if the server negotiates a value that is not a multiple of 4096 (we also have to check to make sure that we do not round it down to zero).
Weakness: CWE-787
Which versions are affected by CVE-2024-26692?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26692?
Apply the vendor's patch.
Is CVE-2024-26692 being exploited?
There is no known exploitation of CVE-2024-26692 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26692, DEBIAN-CVE-2024-26692, GHSA-jc4v-c4mw-rmf8, UBUNTU-CVE-2024-26692.