CVE-2024-53185: smb: client: fix NULL ptr deref in crypto_aead_setkey()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix NULL ptr deref in cryptoaeadsetkey()
Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2GLOBALCAPENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher. See MS-SMB2 3.3.5.4.
Commit b0abcd65ec54 ("smb: client: fix UAF in async decryption") added a @server->ciphertype check to conditionally call smb3cryptoaeadallocate(), but that check would always be false as @server->ciphertype is unset for SMB3.02.
Fix the following KASAN splat by setting @server->ciphertype for SMB3.02 as well.
mount.cifs //srv/share /mnt -o vers=3.02,seal,...
BUG: KASAN: null-ptr-deref in cryptoaeadsetkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x5d/0x80 ? cryptoaeadsetkey+0x2c/0x130 kasanreport+0xda/0x110 ? cryptoaeadsetkey+0x2c/0x130 cryptoaeadsetkey+0x2c/0x130 cryptmessage+0x258/0xec0 [cifs] ? asanmemset+0x23/0x50 ? pfxcryptmessage+0x10/0x10 [cifs] ? marklock+0xb0/0x6a0 ? hlockclass+0x32/0xb0 ? marklock+0xb0/0x6a0 smb3inittransformrq+0x352/0x3f0 [cifs] ? lockacquire.part.0+0xf4/0x2a0 smbsendrqst+0x144/0x230 [cifs] ? pfxsmbsendrqst+0x10/0x10 [cifs] ? hlockclass+0x32/0xb0 ? smb2setuprequest+0x225/0x3a0 [cifs] ? pfxcifscompoundlastcallback+0x10/0x10 [cifs] compoundsendrecv+0x59b/0x1140 [cifs] ? pfxcompoundsendrecv+0x10/0x10 [cifs] ? createobject+0x5e/0x90 ? hlockclass+0x32/0xb0 ? dorawspinunlock+0x9a/0xf0 cifssendrecv+0x23/0x30 [cifs] SMB2tcon+0x3ec/0xb30 [cifs] ? pfxSMB2tcon+0x10/0x10 [cifs] ? lockacquire.part.0+0xf4/0x2a0 ? pfxlockrelease+0x10/0x10 ? dorawspintrylock+0xc6/0x120 ? lockacquire+0x3f/0x90 ? getxid+0x16/0xd0 [cifs] ? pfxSMB2tcon+0x10/0x10 [cifs] ? cifsgetsmbses+0xcdd/0x10a0 [cifs] cifsgetsmbses+0xcdd/0x10a0 [cifs] ? pfxcifsgetsmbses+0x10/0x10 [cifs] ? cifsgettcpsession+0xaa0/0xca0 [cifs] cifsmountgetsession+0x8a/0x210 [cifs] dfsmountshare+0x1b0/0x11d0 [cifs] ? pfxlockacquire+0x10/0x10 ? pfxdfsmountshare+0x10/0x10 [cifs] ? lockacquire.part.0+0xf4/0x2a0 ? findheldlock+0x8a/0xa0 ? hlockclass+0x32/0xb0 ? lockrelease+0x203/0x5d0 cifsmount+0xb3/0x3d0 [cifs] ? dorawspintrylock+0xc6/0x120 ? pfxcifsmount+0x10/0x10 [cifs] ? lockacquire+0x3f/0x90 ? findnls+0x16/0xa0 ? smb3updatemntflags+0x372/0x3b0 [cifs] cifssmb3domount+0x1e2/0xc80 [cifs] ? pfxvfsparsefsstring+0x10/0x10 ? pfxcifssmb3domount+0x10/0x10 [cifs] smb3gettree+0x1bf/0x330 [cifs] vfsgettree+0x4a/0x160 pathmount+0x3c1/0xfb0 ? kasanquarantineput+0xc7/0x1d0 ? pfxpathmount+0x10/0x10 ? kmemcachefree+0x118/0x3e0 ? userpathat+0x74/0xa0 x64sysmount+0x1a6/0x1e0 ? pfxx64sysmount+0x10/0x10 ? markheldlocks+0x1a/0x90 dosyscall64+0xbb/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel (smb client / cifs)to a version that resolves this vulnerability.Patch b0abcd65ec54 - Compensating control
For SMB3.02 mount attempts, ensure encryption is not negotiated with SMB2_GLOBAL_CAP_ENCRYPTION unless the client has the fix that prevents the NULL pointer dereference in crypto_aead_setkey().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53185?
CVE-2024-53185 has a medium severity rating due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2024-53185?
To fix CVE-2024-53185, update your Linux kernel to the patched versions above 6.6.64, 6.11.11, or 6.12.2.
What systems are affected by CVE-2024-53185?
CVE-2024-53185 affects various versions of the Linux kernel between the specified version ranges.
What risks are associated with CVE-2024-53185?
The risks associated with CVE-2024-53185 include potential crashes and denial of service due to the NULL pointer dereference.
When was CVE-2024-53185 reported?
CVE-2024-53185 was resolved in the Linux kernel as part of security updates released following its identification.