Executive Summary

This vulnerability exists in the Linux kernel's SMB client code, specifically in the function symlink_data(). It involves a possible infinite loop and an out-of-bounds (OOB) read on 32-bit architectures.

The infinite loop occurs when the length value (ErrorDataLength) is set to 0xfffffff8, causing a pointer calculation that results in the pointer 'next' pointing back to the same structure 'p', creating a loop.

The out-of-bounds read happens when ErrorDataLength is 0xfffffff0, causing the pointer 'next' to point to memory 8 bytes before the structure 'p', which is outside the valid bounds.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel SMB client to enter an infinite loop or read memory outside of its intended bounds on 32-bit systems.

An infinite loop could lead to a denial of service by consuming CPU resources indefinitely.

An out-of-bounds read could potentially expose sensitive memory contents or cause system instability or crashes.

Useful 0 Not Useful 0