CVE-2023-4130

In the Linux kernel, a flaw was found in the KSMBD server implementation when handling FILE_FULL_EA_INFORMATION requests. The issue arises in the smb2_set_ea() function, where multiple smb2_ea_info buffers are processed using the NextEntryOffset field. KSMBD incorrectly validated the length of the next extended attribute (EA) buffer using the next offset instead of the actual buffer length (buf_len). Since next represents the offset of the current EA rather than the remaining buffer size, this mistake could allow an out-of-bounds access when parsing subsequent entries. This vulnerability could potentially lead to memory corruption or denial of service when processing malicious SMB requests.

No Red Hat products or offerings are affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.