forked from ctrliq/kernel-src-tree
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit deac203
committed
fs/smb/client: Reset password pointer to NULL
jira VULN-9356
cve CVE-2023-5345
commit-author Quang Le <[email protected]>
commit e6e43b8
upstream-diff The mainline `e6e43b8a' commit consisting of a single line
`ctx->password = NULL' is a fix of commit
`a4e430c8c8ba96be8c6ec4f2eb108bb8bcbee069' (not mentioned
anywhere), whose erroneous code is not present in `ciqlts9_2-rt',
so the fix doesn't apply. The `a4e430c8' commit can be treated as
a vulnerability patch itself (erasing passwords stored on heap
upon freeing, thus ensuring that no secrets linger in
RAM). However, it's not a part of CVE-2023-5345, or any other CVE
for that matter.
Forget to reset ctx->password to NULL will lead to bug like double free
Cc: [email protected]
Cc: Willy Tarreau <[email protected]>
Reviewed-by: Namjae Jeon <[email protected]>
Signed-off-by: Quang Le <[email protected]>
Signed-off-by: Steve French <[email protected]>
(cherry picked from commit e6e43b8)
Signed-off-by: Marcin Wcisło <[email protected]>1 parent bb1b0a8 commit deac203Copy full SHA for deac203
File tree
0 file changed
+0
-0
lines changedFilter options
0 file changed
+0
-0
lines changed
0 commit comments