Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 842234 (CVE-2022-27239, CVE-2022-29869) - <net-fs/cifs-utils-6.15: multiple vulnerabilities
Summary: <net-fs/cifs-utils-6.15: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-27239, CVE-2022-29869
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B1 [glsa+]
Keywords:
Depends on: 858137
Blocks:
  Show dependency tree
 
Reported: 2022-05-02 20:16 UTC by John Helmert III
Modified: 2023-11-24 14:21 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-02 20:16:44 UTC
CVE-2022-27239 (https://github.com/piastry/cifs-utils/pull/7/commits/955fb147e97a6a74e1aaa65766de91e2c1479765):
https://bugzilla.samba.org/show_bug.cgi?id=15025
https://bugzilla.suse.com/show_bug.cgi?id=1197216

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

Please bump to 6.14.
Comment 1 Attila Tóth 2022-06-04 06:43:29 UTC
(In reply to John Helmert III from comment #0)
> CVE-2022-27239
> (https://github.com/piastry/cifs-utils/pull/7/commits/
> 955fb147e97a6a74e1aaa65766de91e2c1479765):
> https://bugzilla.samba.org/show_bug.cgi?id=15025
> https://bugzilla.suse.com/show_bug.cgi?id=1197216
> 
> In cifs-utils through 6.14, a stack-based buffer overflow when parsing the
> mount.cifs ip= command-line argument could lead to local attackers gaining
> root privileges.
> 
> Please bump to 6.14.

There's also CVE-2022-29869:
https://nvd.nist.gov/vuln/detail/CVE-2022-29869
https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379

Please bump to 6.15 (latest).
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-06-04 16:04:59 UTC
Indeed, thanks! Not sure how I missed that one.
Comment 3 Larry the Git Cow gentoo-dev 2022-06-24 05:26:23 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5

commit c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5
Author:     Sayan Chowdhury <schowdhury@microsoft.com>
AuthorDate: 2022-06-17 10:07:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-06-24 05:26:08 +0000

    net-fs/cifs-utils: version bump to 6.15
    
    Bug: https://bugs.gentoo.org/842234
    Acked-by: David Seifert <soap@gentoo.org>
    Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
    Closes: https://github.com/gentoo/gentoo/pull/25937
    Signed-off-by: Sam James <sam@gentoo.org>

 net-fs/cifs-utils/Manifest               |   1 +
 net-fs/cifs-utils/cifs-utils-6.15.ebuild | 138 +++++++++++++++++++++++++++++++
 2 files changed, 139 insertions(+)
Comment 4 Hans de Graaff gentoo-dev Security 2023-10-04 05:33:24 UTC
commit ede0964749963f076247c21fbf1284463f6a51c4
Author: Sam James <sam@gentoo.org>
Date:   Fri Sep 30 04:03:21 2022 +0100

    net-fs/cifs-utils: drop 6.13-r1
Comment 5 Larry the Git Cow gentoo-dev 2023-11-24 14:20:16 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=c99aedd76d916c7d282282c93b43664f35bccf07

commit c99aedd76d916c7d282282c93b43664f35bccf07
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-11-24 14:19:44 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2023-11-24 14:20:11 +0000

    [ GLSA 202311-05 ] LinuxCIFS utils: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/842234
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202311-05.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)