GHSA-jf42-2pw2-333x
Record from GitHub Advisory Database · Published November 18, 2024
A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux-qemu-melange | Chainguard | 6.18.16-r0 |
| linux-qemu-6.12 | Chainguard | 6.12.71-r0 |
| linux-vmware-6.12 | Chainguard | 6.12.71-r0 |
| linux-server-7.2 | Chainguard | 7.2.7-r3 |
| linux-vmware-6.18 | Chainguard | 6.18.10-r0 |
| linux-raspberry-pi | Chainguard | 20260911-r6 |
| linux-raspberry-pi-4 | Chainguard | 20260911-r4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | linux-azure-6.18 | * |
| chainguard | linux-qemu-melange | 0 |
| chainguard | linux-qemu-6.12 | 0 |
| chainguard | linux-aws-6.12 | * |
| chainguard | linux-aws-6.18 | * |
| chainguard | linux-qemu-6.18 | * |
| chainguard | linux-gcp-6.18 | * |
| chainguard | linux-aws-generic | * |
| chainguard | linux-azure-generic | * |
| chainguard | linux-gcp-generic | * |
| chainguard | linux-vmware-6.12 | 0 |
| chainguard | linux-server-7.2 | 0 |
| chainguard | linux-vmware-generic | * |
| chainguard | linux-gcp-6.12 | * |
| chainguard | linux-qemu-generic | * |
| chainguard | linux-vmware-6.18 | 0 |
| chainguard | linux-raspberry-pi | 0 |
| chainguard | linux-azure-6.12 | * |
| chainguard | linux-qemu-rc | * |
| chainguard | linux-raspberry-pi-4 | 0 |
Timeline
- Nov 18, 2024 CVE Published
- Apr 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-jf42-2pw2-333x
vulnetix vdb fixes GHSA-jf42-2pw2-333xOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-jf42-2pw2-333x/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart