smb OpenInfoData Corruption

Vulnerability analysis

The SMB client filesystem code allocates a data structure on the kernel stack without clearing it first, so fields that the code does not explicitly set afterward retain whatever random values happened to be in that stack memory. Depending on which fields are left unset and how they are used, this can cause the client to operate on garbage pointer or length values, potentially leading to a kernel crash or memory corruption. The fix zero-initializes the structure at allocation time so that any field not explicitly set defaults to zero. The vulnerable code paths are reached when a local user performs file operations such as querying symlinks, setting file attributes, or creating special files on a mounted CIFS/SMB share, which requires an administrator to have mounted the share but no special privileges to then access it.