CVE-2024-53185

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix NULL ptr deref in crypto_aead_setkey()

Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so

when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response,

the client uses AES-128-CCM as the default cipher. See MS-SMB2

3.3.5.4.

Commit b0abcd65ec54 ("smb: client: fix UAF in async decryption") added

a @server->cipher_type check to conditionally call

smb3_crypto_aead_allocate(), but that check would always be false as

@server->cipher_type is unset for SMB3.02.

Fix the following KASAN splat by setting @server->cipher_type for

SMB3.02 as well.

mount.cifs //srv/share /mnt -o vers=3.02,seal,...

BUG: KASAN: null-ptr-deref in crypto_aead_setkey+0x2c/0x130

Read of size 8 at addr 0000000000000020 by task mount.cifs/1095

CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41

04/01/2014

Call Trace:

<TASK>

d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References