CVE-2024-46795

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: unset the binding mark of a reused connection

Steve French reported null pointer dereference error from sha256 lib.

cifs.ko can send session setup requests on reused connection.

If reused connection is used for binding session, conn->binding can

still remain true and generate_preauth_hash() will not set

sess->Preauth_HashValue and it will be NULL.

It is used as a material to create an encryption key in

ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer

dereference error from crypto_shash_update().

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP PTI

CPU: 8 PID: 429254 Comm: kworker/8:39

Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 )

Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]

RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References