CVE-2023-6606: Kernel: out-of-bounds read vulnerability in smbcalcsize

An Out-Of-Bounds Read vulnerability in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This flaw could allow a local attacker to crash the system or leak internal kernel information.

Refer; https://bugzilla.kernel.org/showbug.cgi?id=218218

[1] Retrieve WordCount and add offset2 to the data part of smb [2] Retrieve a 16-byte value from the calculated pointer

c unsigned int smbCalcSize(void buf) { struct smbhdr ptr = buf; return (sizeof(struct smbhdr) + (2 ptr->WordCount) + 2 / size of the bcc field / + getbcc(ptr)); } ... static inline u16 getbcc(struct smbhdr hdr) { le16 bcptr = (le16 )BCC(hdr);

return getunalignedle16(bcptr);//[2] } ... static inline void BCC(struct smbhdr smb) { return (void )smb + sizeof(smb) + 2 smb->WordCount; //[1] }

[2] cifsdemultiplexthread → standardreceive3 → cifshandlestandard → checkSMB → smbCalcSize

c int checkSMB(char buf, unsigned int totalread, struct TCPServerInfo server) { struct smbhdr smb = (struct smbhdr )buf; u32 rfclen = be32tocpu(smb->smbbuflength); u32 clclen; / calculated length / cifsdbg(FYI, "checkSMB Length: 0x%x, smbbuflength: 0x%x\n", totalread, rfclen);

/ is this frame too small to even get to a BCC? / if (totalread < 2 + sizeof(struct smbhdr)) { ... }

/ otherwise, there is enough to get to the BCC / if (checksmbhdr(smb)) return -EIO; clclen = smbCalcSize(smb);