From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A037620C485 for ; Tue, 1 Apr 2025 15:47:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743522450; cv=none; b=Gs/rRI0g3Slhm4i+S89Sw8W/7GWZps0kT7Src3v6QfMbKyZsEw8YRUTN2Qfb1+Vy52sVto6Xpe8JVjwBi/ozoAJ1185T6x2JsHvZjOOk4c802Is/lDmUnZW5nIQK5lEFTFz3Lsl143v/V/p790hf3DWKVrj30HD8VpfI5q+7mBU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743522450; c=relaxed/simple; bh=f8CePL9khEbOCfcOuFvaDyt8onr4FRaWr93wTnt9emc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ogq8jUuyhrRxsXxkiWUZgvFarvjtNxOyBhGCIq/ojeYfTotMPHWJQQhfMzB/NDFkueJMIX7Lt1JpAdh+TYyUmQkPhl1uYeGdRByNtBpnruB0qhy4M+Oi5jCiIyfaIUi48cpaj9mkcKi1AsohZQ6MMSOhqiSqa7f7fA6H/WcgqzQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=o4+pkCqq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="o4+pkCqq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BD460C4CEE4; Tue, 1 Apr 2025 15:47:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1743522450; bh=f8CePL9khEbOCfcOuFvaDyt8onr4FRaWr93wTnt9emc=; h=From:To:Cc:Subject:Date:Reply-to:From; b=o4+pkCqqlxPklfOXgWWdj4saq/DiMkJi8bHxUzE0epLH7lSn8Y4A9t9sGI/iwITrp eoMzRhJKSkKH+a8OSl2vWQx7TIiUGCxP4yB3Otz9jCboq9LG6d49Vtv6qz2uWKyvq0 XIpcbhF9q6SelRgrfXaUQHAaHususL9FZTR/+0/4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option Date: Tue, 1 Apr 2025 16:45:49 +0100 Message-ID: <2025040145-CVE-2025-21964-e2c1@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2732; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=f8CePL9khEbOCfcOuFvaDyt8onr4FRaWr93wTnt9emc=; b=owGbwMvMwCRo6H6F97bub03G02pJDOlvuDS/sRzJfxYQ83anlp3E0brPnBJ3Q5Mnyf6ZdpXZN mh1a55pRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkuDbDgjafeVHTfVLdTf7L np2pW87x8Fd0OsN8b4/smSeUA4s28O08Mymqo/34+fodAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. The Linux kernel CVE team has assigned CVE-2025-21964 to this issue. Affected and fixed versions =========================== Issue introduced in 5.12 with commit 5780464614f6abe6026f00cf5a0777aa453ba450 and fixed in 6.1.132 with commit dd190168e60ac15408f074a1fe0ce36aff34027b Issue introduced in 5.12 with commit 5780464614f6abe6026f00cf5a0777aa453ba450 and fixed in 6.6.84 with commit 0252c33cc943e9e48ddfafaa6b1eb72adb68a099 Issue introduced in 5.12 with commit 5780464614f6abe6026f00cf5a0777aa453ba450 and fixed in 6.12.20 with commit 833f2903eb8b70faca7967319e580e9ce69729fc Issue introduced in 5.12 with commit 5780464614f6abe6026f00cf5a0777aa453ba450 and fixed in 6.13.8 with commit 5f500874ab9b3cc8c169c2ab49f00b838520b9c5 Issue introduced in 5.12 with commit 5780464614f6abe6026f00cf5a0777aa453ba450 and fixed in 6.14 with commit 7489161b1852390b4413d57f2457cd40b34da6cc Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-21964 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/smb/client/fs_context.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/dd190168e60ac15408f074a1fe0ce36aff34027b https://git.kernel.org/stable/c/0252c33cc943e9e48ddfafaa6b1eb72adb68a099 https://git.kernel.org/stable/c/833f2903eb8b70faca7967319e580e9ce69729fc https://git.kernel.org/stable/c/5f500874ab9b3cc8c169c2ab49f00b838520b9c5 https://git.kernel.org/stable/c/7489161b1852390b4413d57f2457cd40b34da6cc