forked from ctrliq/kernel-src-tree
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit 00d256a
committed
fs/smb/client: Reset password pointer to NULL
jira VULN-8159
cve CVE-2023-5345
commit-author Quang Le <[email protected]>
commit e6e43b8
upstream-diff The mainline `e6e43b8a' commit consisting of a single
line `ctx->password = NULL' is a fix of commit
`a4e430c8c8ba96be8c6ec4f2eb108bb8bcbee069' (not mentioned
anywhere), whose erroneous code is not present in `ciqlts9_2', so
the fix doesn't apply. The `a4e430c8' commit can be treated as a
vulnerability patch itself (erasing passwords stored on heap upon
freeing, thus ensuring that no secrets linger in RAM). However,
it's not a part of CVE-2023-5345, or any other CVE for that
matter.
Forget to reset ctx->password to NULL will lead to bug like double free
Cc: [email protected]
Cc: Willy Tarreau <[email protected]>
Reviewed-by: Namjae Jeon <[email protected]>
Signed-off-by: Quang Le <[email protected]>
Signed-off-by: Steve French <[email protected]>
(cherry picked from commit e6e43b8)
Signed-off-by: Marcin Wcisło <[email protected]>
# Conflicts:
# fs/cifs/fs_context.c1 parent 963fd18 commit 00d256aCopy full SHA for 00d256a
File tree
0 file changed
+0
-0
lines changedFilter options
0 file changed
+0
-0
lines changed
0 commit comments