ID |
CVE-2025-57632
|
Sažetak |
libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256). An attacker can craft responses with many chained PDUs to overflow v->niov and perform heap out-of-bounds writes, causing memory corruption, crashes, and potentially arbitrary code execution. The SMB2_OPLOCK_BREAK path bypasses message ID validation. |
Reference |
|
CVSS |
Base: | 0.0 |
Impact: | None |
Exploitability: | None |
|
Pristup |
Vektor | Složenost | Autentikacija |
None |
None |
None |
|
Impact |
Povjerljivost | Cjelovitost | Dostupnost |
None |
None |
None |
|
CVSS vektor |
None |
Zadnje važnije ažuriranje |
25-09-2025 - 20:15 |
Objavljeno |
25-09-2025 - 20:15 |