CVE-2024-0565: Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receiveencryptedstandard of client

— Microsoft

Linux Kernel CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability.

This case affected the cifs.ko, which is linux CIFS file system module, the client side of the CIFS didn't validate the NextCommand field, which is controlled from server side, it leads to DoS (due to OOB read on the memcpy source buffer) and wild copy (due to integer underflow on the memcpy length), both results are caused by the NextCommand without validation, that's why they merged into same case

Reference; https://www.spinics.net/lists/stable-commits/msg328851.html

— Red Hat

Linux Kernel could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an out-of-bounds memory read due to an integer underflow on the memcpy length. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

— IBM