CVE-2024-46795: ksmbd: unset the binding mark of a reused connection
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: unset the binding mark of a reused connection
Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generatepreauthhash() will not set sess->PreauthHashValue and it will be NULL. It is used as a material to create an encryption key in ksmbdgensmb311encryptionkey. ->PreauthHashValue cause null pointer dereference error from cryptoshashupdate().
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handleksmbdwork [ksmbd] RIP: 0010:libsha256basedoupdate.isra.0+0x11e/0x1d0 [sha256ssse3] <TASK> ? showregs+0x6d/0x80 ? die+0x24/0x80 ? pagefaultoops+0x99/0x1b0 ? douseraddrfault+0x2ee/0x6b0 ? excpagefault+0x83/0x1b0 ? asmexcpagefault+0x27/0x30 ? pfxsha256transformrorx+0x10/0x10 [sha256ssse3] ? libsha256basedoupdate.isra.0+0x11e/0x1d0 [sha256ssse3] ? pfxsha256transformrorx+0x10/0x10 [sha256ssse3] ? pfxsha256transformrorx+0x10/0x10 [sha256ssse3] sha256update+0x77/0xa0 [sha256ssse3] sha256avx2update+0x15/0x30 [sha256ssse3] cryptoshashupdate+0x1e/0x40 hmacupdate+0x12/0x20 cryptoshashupdate+0x1e/0x40 generatekey+0x234/0x380 [ksmbd] generatesmb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbdgensmb311encryptionkey+0x72/0xa0 [ksmbd] ntlmauthenticate.isra.0+0x423/0x5d0 [ksmbd] smb2sesssetup+0x952/0xaa0 [ksmbd] processrequest+0xa3/0x1d0 [ksmbd] handleksmbdwork+0x1c4/0x2f0 [ksmbd] handleksmbdwork+0x2d/0xa0 [ksmbd] processonework+0x16c/0x350 workerthread+0x306/0x440 ? pfxworkerthread+0x10/0x10 kthread+0xef/0x120 ? pfxkthread+0x10/0x10 retfromfork+0x44/0x70 ? pfxkthread+0x10/0x10 retfromforkasm+0x1b/0x30 </TASK>
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46795?
CVE-2024-46795 has been marked with a moderate severity level due to its potential for causing null pointer dereference errors.
How do I fix CVE-2024-46795?
To remediate CVE-2024-46795, upgrade the Linux kernel to a version higher than 5.15.167 or apply the recommended patches provided in the security updates.
Which versions of the Linux kernel are affected by CVE-2024-46795?
CVE-2024-46795 affects multiple versions of the Linux kernel from 5.15 to 6.11-rc6.
What types of systems are impacted by CVE-2024-46795?
CVE-2024-46795 affects systems running specific vulnerable versions of the Linux kernel, particularly those using ksmbd and cifs.ko functionalities.
Who reported CVE-2024-46795?
CVE-2024-46795 was reported by Steve French, highlighting a critical null pointer dereference issue.