229 lines
12 KiB
JSON
229 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-22037",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-12-29T08:45:45.809Z",
|
|
"datePublished": "2025-04-16T14:11:55.670Z",
|
|
"dateUpdated": "2026-10-30T12:21:08.185Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:21:08.185Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in alloc_preauth_hash()\n\nThe Client send malformed smb2 negotiate request. ksmbd return error\nresponse. Subsequently, the client can send smb2 session setup even\nthought conn->preauth_info is not allocated.\nThis patch add KSMBD_SESS_NEED_SETUP status of connection to ignore\nsession setup request if smb2 negotiate phase is not complete."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - ksmbd is the in-kernel SMB server processing attacker-supplied SMB2 NEGOTIATE and SESSION_SETUP PDUs from any remote client on TCP/445. The entire trigger sequence consists of network packets sent over a single TCP connection.\nAC:L - The attacker fully controls all three PDUs and the sequence is deterministic — a valid SMB 3.1.1 negotiate, a second negotiate with no preauth-integrity context, then a session setup — with no race, timing, or memory-layout dependency.\nPR:N - SMB2_SESSION_SETUP_HE is explicitly exempted from session validation in smb2_check_user_session(), and the crash occurs in generate_preauth_hash() before any credential is verified. No account or authentication on the SMB server is required.\nUI:N - The attacker drives the whole sequence by connecting to the listening ksmbd socket; no action by an administrator, local user, or SMB client is needed.\nS:U - The NULL dereference occurs in kernel context within the ksmbd connection handler and its impact is confined to the kernel's own security authority, with no crossing into a hypervisor, IOMMU, or sandbox boundary.\nC:N - The faulting access is a fixed read of offsetof(struct preauth_integrity_info, Preauth_HashValue) from a NULL pointer, which faults immediately; no data is copied out and no attacker-controlled offset exists to turn it into a disclosure primitive.\nI:N - The bug is a read-side NULL dereference in kmemdup() with no out-of-bounds or freed-object write, so no kernel memory or control-flow state can be modified.\nA:H - An unauthenticated remote client reliably triggers a kernel oops in the ksmbd worker while conn->srv_mutex is held and conn->r_count is outstanding, leaving the connection permanently stuck and the server unable to reclaim it; on kernels with panic_on_oops this is an immediate full system panic."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/server/connection.h",
|
|
"fs/smb/server/mgmt/user_session.c",
|
|
"fs/smb/server/smb2pdu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
|
|
"lessThan": "2d3461d6ae74ebdcd4d65128c855198649bcadcd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
|
|
"lessThan": "cce57cd8c5dead24127cf2308fdd60fcad2d6ba6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
|
|
"lessThan": "ca8bed31edf728a662ef9d6f39f50e7a7dc2b5ad",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
|
|
"lessThan": "8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
|
|
"lessThan": "b8eb243e670ecf30e91524dd12f7260dac07d335",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
|
|
"lessThan": "c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/server/connection.h",
|
|
"fs/smb/server/mgmt/user_session.c",
|
|
"fs/smb/server/smb2pdu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.107",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.23",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.13.11",
|
|
"lessThanOrEqual": "6.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14.2",
|
|
"lessThanOrEqual": "6.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.15",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.6.107"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.12.23"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.13.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.14.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.15"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2d3461d6ae74ebdcd4d65128c855198649bcadcd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/cce57cd8c5dead24127cf2308fdd60fcad2d6ba6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ca8bed31edf728a662ef9d6f39f50e7a7dc2b5ad"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b8eb243e670ecf30e91524dd12f7260dac07d335"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-310/"
|
|
}
|
|
],
|
|
"title": "ksmbd: fix null pointer dereference in alloc_preauth_hash()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |