Executive brief
A vulnerability was identified in the Linux kernel's SMB (Server Message Block) client, which is used to connect to network file shares. Under specific conditions, such as low system memory, the system could experience a crash (null pointer dereference) when processing encrypted network traffic. This could lead to a denial-of-service state, impacting the availability of the affected system.
Technical details
A vulnerability exists in the Linux kernel SMB client (CIFS) within the 'receive_encrypted_standard()' function in 'fs/smb/client/smb2ops.c'. The code fails to verify the return values of 'cifs_buf_get()' and 'cifs_small_buf_get()'. If these functions return NULL (typically during memory exhaustion), the subsequent 'memcpy' operation results in a null pointer dereference. An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). Patches have been released across multiple stable kernel branches to include the necessary null checks.
Affected products
- Linux Linux Kernel 5.10.211, 5.15.150, 6.1.130, 6.6.80, 6.12.17, 6.13.5
Timeline
- 2025-03-12: disclosed
- 2025-03-12: advisory
References
- https://git.kernel.org/stable/c/24e8e4523d3071bc5143b0db9127d511489f7b3b
- https://git.kernel.org/stable/c/554736b583f529ee159aa95af9a0cbc12b5ffc96
- https://git.kernel.org/stable/c/860ca5e50f73c2a1cef7eefc9d39d04e275417f7
- https://git.kernel.org/stable/c/9e5d99a4cf2e23c716b44862975548415fae5391
- https://git.kernel.org/stable/c/a9b0b4b29877cb4dc5d0842b59b5ccbacddb85bd
- https://git.kernel.org/stable/c/f277e479eea3d1aa18bc712abe1d2bf3dece2e30
- https://git.kernel.org/stable/c/f618aeb6cad2307e48a641379db610abcf593edf