NetSight
IP …
critical9.1

CVE-2022-49058

In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/cry…

Impact

In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max) It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.37 before 4.9.311
from 4.10 before 4.14.276
from 4.15 before 4.19.239
from 4.20 before 5.4.190
from 5.5 before 5.10.112
from 5.11 before 5.15.35

Weakness classification

CWE-120

References