CVE-2011-3363: Input Validation
Currently, we skip doing the ispathaccessible check in cifsmount if there is no prefixpath. There is a report of at least one server however that allows a TREECONNECT to a share that has a DFS referral at its root. UNC that had no prefixpath was used in that case, so the ispathaccessible check was not triggered and the box later hit a BUG() because we were chasing a DFS referral on the root dentry for the mount. Upstream fix: 70945643722ffeac779d2529a348f99567fa5c33
References: https://bugzilla.redhat.com/showbug.cgi?id=682829 https://github.com/torvalds/linux/commit/70945643722ffeac779d2529a348f99567fa5c33
Acknowledgements:
Red Hat would like to thank Yogesh Sharma for reporting this issue.
Other sources
The setupcifssb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3363?
CVE-2011-3363 has a medium severity level due to potential unauthorized access through the DFS referral.
How do I fix CVE-2011-3363?
To fix CVE-2011-3363, update to an unaffected version of the Linux kernel or apply the relevant patches addressing this vulnerability.
What systems are affected by CVE-2011-3363?
CVE-2011-3363 affects Linux kernel versions up to 2.6.39 and Red Hat Enterprise Linux 4.0.
What does CVE-2011-3363 exploit?
CVE-2011-3363 exploits a flaw in the CIFS implementation in the Linux kernel that skips access checks under certain conditions.
Is there public knowledge about CVE-2011-3363?
Yes, CVE-2011-3363 has been publicly disclosed and discussed in security forums and documentation.