DocumentationOverview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an absolute path with convert_to_unix_name() and resolves it from AT_FDCWD via start_creating_path(), so a “..” component is walked from the real filesystem root and escapes the export.
An authenticated client races a missing path component so the rooted open lookup returns -ENOENT (taking the create branch) while the same component is present (a directory) when the create walk runs; the create then resolves “..” out of the share.
Root the create walk at the share like the lookup and rename paths already are: resolve the parent with vfs_path_parent_lookup(…, LOOKUP_BENEATH, &share_conf->vfs_path) and create the final component with start_creating_noperm(). convert_to_unix_name() then has no callers and is removed.
Details
- Affected product:
- Debian 10 ELS
- Affected packages:
- linux @ 4.19.0
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Ubuntu 24.04 | Planned | — |
| Ubuntu 24.04 AWS | Planned | — |
| Ubuntu 26.04 | Released |
1 kernel
|