Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 842234 (CVE-2022-27239, CVE-2022-29869) - <net-fs/cifs-utils-6.15: multiple vulnerabilities
Summary: <net-fs/cifs-utils-6.15: multiple vulnerabilities
Status: IN_PROGRESS
Alias: CVE-2022-27239, CVE-2022-29869
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B1 [stable?]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-05-02 20:16 UTC by John Helmert III
Modified: 2022-06-24 05:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-02 20:16:44 UTC
CVE-2022-27239 (https://github.com/piastry/cifs-utils/pull/7/commits/955fb147e97a6a74e1aaa65766de91e2c1479765):
https://bugzilla.samba.org/show_bug.cgi?id=15025
https://bugzilla.suse.com/show_bug.cgi?id=1197216

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

Please bump to 6.14.
Comment 1 Attila Tóth 2022-06-04 06:43:29 UTC
(In reply to John Helmert III from comment #0)
> CVE-2022-27239
> (https://github.com/piastry/cifs-utils/pull/7/commits/
> 955fb147e97a6a74e1aaa65766de91e2c1479765):
> https://bugzilla.samba.org/show_bug.cgi?id=15025
> https://bugzilla.suse.com/show_bug.cgi?id=1197216
> 
> In cifs-utils through 6.14, a stack-based buffer overflow when parsing the
> mount.cifs ip= command-line argument could lead to local attackers gaining
> root privileges.
> 
> Please bump to 6.14.

There's also CVE-2022-29869:
https://nvd.nist.gov/vuln/detail/CVE-2022-29869
https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379

Please bump to 6.15 (latest).
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-06-04 16:04:59 UTC
Indeed, thanks! Not sure how I missed that one.
Comment 3 Larry the Git Cow gentoo-dev 2022-06-24 05:26:23 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5

commit c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5
Author:     Sayan Chowdhury <schowdhury@microsoft.com>
AuthorDate: 2022-06-17 10:07:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-06-24 05:26:08 +0000

    net-fs/cifs-utils: version bump to 6.15
    
    Bug: https://bugs.gentoo.org/842234
    Acked-by: David Seifert <soap@gentoo.org>
    Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
    Closes: https://github.com/gentoo/gentoo/pull/25937
    Signed-off-by: Sam James <sam@gentoo.org>

 net-fs/cifs-utils/Manifest               |   1 +
 net-fs/cifs-utils/cifs-utils-6.15.ebuild | 138 +++++++++++++++++++++++++++++++
 2 files changed, 139 insertions(+)