Vulnerability in cifs package: NULL ptr dereference in smb2_ioctl_query_info()
Summary
GSD-2022-1001913: cifs: fix NULL ptr dereference in smb2_ioctl_query_info(). Affects Kernel versions < 39a4bf7d1a23dd172526c2fb0db480c5d5c63bd6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cifs package is a component of the Linux Kernel ecosystem. It provides support for the Common Internet File System (CIFS) protocol, allowing Linux systems to access files and resources on remote Windows servers. CIFS is widely used for network file sharing in mixed Windows and Linux environments. The vulnerability in question involves a NULL pointer dereference in the smb2_ioctl_query_info() function of the cifs package.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the smb2_ioctl_query_info() function of the cifs package. This can occur when the function is called with a specific set of parameters, leading to a crash or potential code execution. The impact and attack plausibility of this vulnerability have not been proven yet. However, if successfully exploited, an attacker could potentially gain unauthorized access to sensitive information or disrupt the normal operation of the affected system. The vulnerability has been fixed in the Linux Kernel version v5.15.33 by commit 39a4bf7d1a23dd172526c2fb0db480c5d5c63bd6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The cifs package in the Linux Kernel is vulnerable to a NULL pointer dereference in the smb2_ioctl_query_info() function. This vulnerability can potentially lead to unauthorized access or system disruption. It is recommended to update the Linux Kernel to version v5.15.33 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The cifs package is a component of the Linux Kernel ecosystem that provides support for the Common Internet File System (CIFS) protocol, enabling Linux systems to access files and resources on remote Windows servers.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a pointer that has not been assigned a valid memory address (i.e., it points to NULL). This can lead to crashes, unexpected behavior, or potential security vulnerabilities.
The smb2_ioctl_query_info() function is a specific function within the cifs package that is responsible for querying information from a remote Windows server using the SMB2 protocol. It is used to retrieve various attributes and metadata about files or directories.
If successfully exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive information stored on remote Windows servers or disrupt the normal operation of the affected system.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.15.33 by commit 39a4bf7d1a23dd172526c2fb0db480c5d5c63bd6.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
