CVE-2018-1066: Null Pointer Dereference
Last updated 4 July 2026
Other sources
Null pointer dereference was found in fs/cifs/cifsencrypt.c:setupntlmv2rsp() function that is triggered when empty TargetInfo is returned in NTLMSSP setup negotiation response from Samba server allowing to crash client's kernel.
Bug report:
https://patchwork.kernel.org/patch/10187633/
— Red Hat
The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setupntlmv2rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.11 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernel (CIFS fs/cifs)to a version that resolves this vulnerability.Fixed in 4.11 - Compensating control
If you cannot upgrade immediately, mitigate the risk by avoiding mounting CIFS shares from untrusted/attacker-controlled Samba servers, since a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() can be triggered by an empty TargetInfo returned in the NTLMSSP setup negotiation response.
Event History
Frequently Asked Questions
What is the vulnerability ID for this Linux kernel vulnerability?
The vulnerability ID is CVE-2018-1066.
What is the severity of CVE-2018-1066?
The severity of CVE-2018-1066 is medium.
Which Linux kernel versions are affected by CVE-2018-1066?
Linux kernel versions before 4.11 are affected by CVE-2018-1066.
How can an attacker exploit CVE-2018-1066?
An attacker controlling a CIFS server can exploit CVE-2018-1066 by kernel panicking a client that has this server mounted.
Where can I find more information about CVE-2018-1066?
You can find more information about CVE-2018-1066 in the references provided: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cabfb3680f78981d26c078a26e5c748531257ebb, https://bugzilla.redhat.com/show_bug.cgi?id=1539599, https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb.