oss-security - 5 Linux kernel ksmbd vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 18 Mar 2024 21:59:12 +0100
From: daniel <sd@....eu>
To: oss-security@...ts.openwall.com
Subject: 5 Linux kernel ksmbd vulnerabilities

Recently two batches of Linux kernel ksmbd vulnerabilities became public.

Please find here an overview, the attached ZDI information and the 
corresponding links to the Linux kernel cve announce messages with 
further information.

###
##	batch one
###
CVE            Link
--------------+---------------------------------------------------------+-----
CVE-2024-26594 https://www.zerodayinitiative.com/advisories/ZDI-24-194/
CVE-2024-26592 https://www.zerodayinitiative.com/advisories/ZDI-24-195/

Vendor notified: 2024-01-11
Coordinated public release date: 2024-02-23

Fixed in following kernels:
Fixed in 6.1.75
Fixed in 6.6.14
Fixed in 6.7.2
Fixed in 6.8-rc1

https://lore.kernel.org/linux-cve-announce/2024022259-CVE-2024-26592-58f7@gregkh/T/#u
https://lore.kernel.org/linux-cve-announce/2024022325-CVE-2024-26594-1cbc%40gregkh/

###
##	batch two
###
CVE            Link
--------------+---------------------------------------------------------+-----
CVE-2023-52442 https://www.zerodayinitiative.com/advisories/ZDI-24-227/
CVE-2023-52441 https://www.zerodayinitiative.com/advisories/ZDI-24-228/
CVE-2023-52440 https://www.zerodayinitiative.com/advisories/ZDI-24-229/

Vendor notified: 2023-07-18 - 2023-08-24
Coordinated public release date: 2024-03-01

Fixed in following kernels:
Fixed in 5.15.145
Fixed in 6.1.53
Fixed in 6.4.16
Fixed in 6.5

https://lore.kernel.org/linux-cve-announce/2024022132-unvented-arguably-5ea9@gregkh/T/#u
https://lore.kernel.org/linux-cve-announce/2024022129-gently-activity-ca7d@gregkh/T/#u
https://lore.kernel.org/linux-cve-announce/2024022123-glance-wrinkle-26c1@gregkh/T/#u

###
##	links to reports of older ksmbd vulnerabilities
###
https://www.openwall.com/lists/oss-security/2023/01/04/1
https://www.openwall.com/lists/oss-security/2022/12/22/8
View attachment "ZDI-24-194-ZDI-CAN-22890-CVE-2024-26594.txt" of type "text/plain" (1414 bytes)

View attachment "ZDI-24-195-ZDI-CAN-22991-CVE-2024-26592.txt" of type "text/plain" (1309 bytes)

View attachment "ZDI-24-227-ZDI-CAN-21506-CVE-2023-52442.txt" of type "text/plain" (1399 bytes)

View attachment "ZDI-24-228-ZDI-CAN-21541-CVE-2023-52441.txt" of type "text/plain" (1428 bytes)

View attachment "ZDI-24-229-ZDI-CAN-21940-CVE-2023-52440.txt" of type "text/plain" (1392 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.