In the Linux kernel, the following vulnerability has been resolved:
ksmbd: unset the binding mark of a reused connection
Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update().
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade perfUpgrade python-perfUpgrade kernelUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.167-112.165Upgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfo | Oct 3, 2024 | Sep 18, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Oct 7, 2024 | Sep 18, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 21, 2024 | Sep 18, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-oem-20.04dUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-azureUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-intelUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-gkeUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-6.8Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-50-genericUpgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-oem-24.04aUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-oracleUpgrade linux-image-awsUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-oracle-64k | Nov 12, 2024 | Sep 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub