CVE-2024-0565mediumCWE-191

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 2.0%

exploitation probability

2.0%top 21% of all CVEs

observed exploitation

nono source reports it

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

kernelRed Hat · Red Hat Enterprise Linux 6 Red Hat · Red Hat Enterprise Linux 7 Red Hat · Red Hat Enterprise Linux 8 Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support Red Hat · Red Hat Enterprise Linux 9 Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support Red Hat · Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat · RHOL-5.7-RHEL-8

References