CVE-2024-46795

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: unset the binding mark of a reused connection<br /> <br /> Steve French reported null pointer dereference error from sha256 lib.<br /> cifs.ko can send session setup requests on reused connection.<br /> If reused connection is used for binding session, conn-&gt;binding can<br /> still remain true and generate_preauth_hash() will not set<br /> sess-&gt;Preauth_HashValue and it will be NULL.<br /> It is used as a material to create an encryption key in<br /> ksmbd_gen_smb311_encryptionkey. -&gt;Preauth_HashValue cause null pointer<br /> dereference error from crypto_shash_update().<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> PGD 0 P4D 0<br /> Oops: 0000 [#1] PREEMPT SMP PTI<br /> CPU: 8 PID: 429254 Comm: kworker/8:39<br /> Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 )<br /> Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]<br /> RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]<br /> <br /> ? show_regs+0x6d/0x80<br /> ? __die+0x24/0x80<br /> ? page_fault_oops+0x99/0x1b0<br /> ? do_user_addr_fault+0x2ee/0x6b0<br /> ? exc_page_fault+0x83/0x1b0<br /> ? asm_exc_page_fault+0x27/0x30<br /> ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]<br /> ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3]<br /> ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]<br /> ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3]<br /> _sha256_update+0x77/0xa0 [sha256_ssse3]<br /> sha256_avx2_update+0x15/0x30 [sha256_ssse3]<br /> crypto_shash_update+0x1e/0x40<br /> hmac_update+0x12/0x20<br /> crypto_shash_update+0x1e/0x40<br /> generate_key+0x234/0x380 [ksmbd]<br /> generate_smb3encryptionkey+0x40/0x1c0 [ksmbd]<br /> ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd]<br /> ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd]<br /> smb2_sess_setup+0x952/0xaa0 [ksmbd]<br /> __process_request+0xa3/0x1d0 [ksmbd]<br /> __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd]<br /> handle_ksmbd_work+0x2d/0xa0 [ksmbd]<br /> process_one_work+0x16c/0x350<br /> worker_thread+0x306/0x440<br /> ? __pfx_worker_thread+0x10/0x10<br /> kthread+0xef/0x120<br /> ? __pfx_kthread+0x10/0x10<br /> ret_from_fork+0x44/0x70<br /> ? __pfx_kthread+0x10/0x10<br /> ret_from_fork_asm+0x1b/0x30<br />