Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 842234 (CVE-2022-27239, CVE-2022-29869) - <net-fs/cifs-utils-6.15: multiple vulnerabilities
Summary: <net-fs/cifs-utils-6.15: multiple vulnerabilities
Status: IN_PROGRESS
Alias: CVE-2022-27239, CVE-2022-29869
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B1 [glsa? cleanup]
Keywords:
Depends on: 858137
Blocks:
  Show dependency tree
 
Reported: 2022-05-02 20:16 UTC by John Helmert III
Modified: 2022-07-16 16:39 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-02 20:16:44 UTC 
CVE-2022-27239 (https://github.com/piastry/cifs-utils/pull/7/commits/955fb147e97a6a74e1aaa65766de91e2c1479765):
https://bugzilla.samba.org/show_bug.cgi?id=15025
https://bugzilla.suse.com/show_bug.cgi?id=1197216

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

Please bump to 6.14.
Comment 1 Attila Tóth 2022-06-04 06:43:29 UTC 
(In reply to John Helmert III from comment #0)
> CVE-2022-27239
> (https://github.com/piastry/cifs-utils/pull/7/commits/
> 955fb147e97a6a74e1aaa65766de91e2c1479765):
> https://bugzilla.samba.org/show_bug.cgi?id=15025
> https://bugzilla.suse.com/show_bug.cgi?id=1197216
> 
> In cifs-utils through 6.14, a stack-based buffer overflow when parsing the
> mount.cifs ip= command-line argument could lead to local attackers gaining
> root privileges.
> 
> Please bump to 6.14.

There's also CVE-2022-29869:
https://nvd.nist.gov/vuln/detail/CVE-2022-29869
https://github.com/piastry/cifs-utils/commit/8acc963a2e7e9d63fe1f2e7f73f5a03f83d9c379

Please bump to 6.15 (latest).
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-06-04 16:04:59 UTC 
Indeed, thanks! Not sure how I missed that one.
Comment 3 Larry the Git Cow gentoo-dev 2022-06-24 05:26:23 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5

commit c1515cb2fdfbf0ea5785afcbf17a78baf5f5b3e5
Author:     Sayan Chowdhury <schowdhury@microsoft.com>
AuthorDate: 2022-06-17 10:07:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-06-24 05:26:08 +0000

    net-fs/cifs-utils: version bump to 6.15
    
    Bug: https://bugs.gentoo.org/842234
    Acked-by: David Seifert <soap@gentoo.org>
    Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
    Closes: https://github.com/gentoo/gentoo/pull/25937
    Signed-off-by: Sam James <sam@gentoo.org>

 net-fs/cifs-utils/Manifest               |   1 +
 net-fs/cifs-utils/cifs-utils-6.15.ebuild | 138 +++++++++++++++++++++++++++++++
 2 files changed, 139 insertions(+)