cifs: NULL dereference vulnerability in cifs_compose_mount_options()
Summary
GSD-2021-1001150: cifs: prevent NULL deref in cifs_compose_mount_options(). Affects Kernel versions < ae3d181f4e912f51af7776ea165f199b16fc165d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cifs package is a component of the Linux Kernel that provides support for the Common Internet File System (CIFS) protocol. CIFS allows Linux systems to access files and resources on remote Windows servers. The cifs_compose_mount_options() function is responsible for composing the mount options used when mounting a CIFS share. This vulnerability in cifs_compose_mount_options() can lead to a NULL dereference, potentially resulting in a system crash or other unexpected behavior.
Vulnerability Detail
The vulnerability in cifs_compose_mount_options() arises from a failure to handle a NULL pointer properly. When certain conditions are met, an attacker could exploit this vulnerability to trigger a NULL dereference, leading to a denial of service (system crash) or potentially allowing for further exploitation. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability has been addressed in Linux Kernel version v5.13.5 by commit ae3d181f4e912f51af7776ea165f199b16fc165d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The NULL dereference vulnerability in cifs_compose_mount_options() can potentially lead to a system crash or further exploitation. It is crucial to update the Linux Kernel to version v5.13.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can range from a system crash (denial of service) to potential further exploitation by an attacker.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
As of now, there is no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
While there is no specific workaround mentioned for this vulnerability, it is generally recommended to follow security best practices such as restricting network access to vulnerable systems and monitoring for any suspicious activity.
You can find more information about this vulnerability in the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the associated commit ae3d181f4e912f51af7776ea165f199b16fc165d.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
