Vulnerability in Kernel package: cifs: Return correct error code from smb2_get_enc_key
Summary
GSD-2021-1000148: cifs: Return correct error code from smb2_get_enc_key. Affects Kernel versions >= 61cfac6f267dabcf2740a7ec8a0295833b28b5f5, < aaa0faa5c28a91c362352d6b35dc3ed10df56fb0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as process management, memory management, and device drivers. The cifs module within the Kernel package enables Linux to support the Common Internet File System (CIFS) protocol, allowing the system to access files and resources on remote servers. However, a vulnerability has been discovered in the cifs module that affects the smb2_get_enc_key function.
Vulnerability Detail
The smb2_get_enc_key function in the cifs module of the Kernel package is affected by a vulnerability. This vulnerability, identified as GSD-2021-1000148, was introduced in version v4.11 of the Linux Kernel and fixed in version v5.10.36. The vulnerability arises from an incorrect error code being returned from the smb2_get_enc_key function. The impact and attack plausibility of this vulnerability have not been proven yet. However, if exploited, it could potentially lead to security breaches or unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Kernel package, there is no specific workaround available. It is advised to update to the latest version to ensure the vulnerability is mitigated.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's cifs module, specifically in the smb2_get_enc_key function. This vulnerability can potentially result in security breaches or unauthorized access to sensitive information. It is recommended to update the Kernel package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a crucial component of the Linux operating system, responsible for managing core system functionality.
The cifs module enables Linux to support the Common Internet File System (CIFS) protocol, allowing access to files and resources on remote servers.
The smb2_get_enc_key function is a part of the cifs module and is used for obtaining encryption keys in the SMB2 protocol.
The impact of this vulnerability is not yet proven, but if exploited, it could potentially lead to security breaches or unauthorized access to sensitive information.
To fix this vulnerability, update the Linux Kernel package to version v5.10.36 or later.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
