222 lines
12 KiB
JSON
222 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-64389",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T15:36:31.785Z",
|
|
"datePublished": "2026-07-25T08:50:36.817Z",
|
|
"dateUpdated": "2026-10-30T12:27:50.295Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:27:50.295Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess->sess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess->sess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n smb2_sess_setup()\n -> conn->binding = true\n -> ntlm_authenticate()\n -> session_user()\n -> ksmbd_decode_ntlmssp_auth_blob()\n -> ksmbd_auth_ntlmv2()\n -> calc_ntlmv2_hash()\n -> hmac_md5_usingrawkey(..., sess->sess_key)\n -> crypto_memneq() returns mismatch\n -> KEY_XCH arc4_crypt(..., sess->sess_key, ...)\n -> out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess->sess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
|
|
"baseScore": 8.2,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The vulnerable NTLMv2 authentication path is reached remotely through ksmbd SESSION_SETUP requests over SMB on TCP/445.\nAC:L - An attacker can deterministically trigger the key overwrite using a malformed multichannel binding request with KEY_XCH; no race or condition beyond attacker control is required.\nPR:N - The overwrite occurs before NTLMv2 proof validation, and the affected code does not verify the binding request signature, so valid credentials or an authenticated attacker session are unnecessary.\nUI:N - No victim action is required beyond an active SMB session, which can belong to an automated client or service.\nS:U - The corrupted session state and resulting effects remain within the ksmbd server and host kernel security authority.\nC:N - The bounded session-key overwrite does not disclose the prior key, kernel memory, or protected SMB data.\nI:L - The attacker can modify an established session's security-critical key state, but cannot reliably select the resulting key or obtain an arbitrary memory or file-write primitive.\nA:H - Repeated unauthenticated key corruption can desynchronize signing-key derivation and render targeted multichannel binding or session recovery unusable, causing complete loss of the affected SMB session in dependent deployments."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/server/auth.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
|
|
"lessThan": "e589e997bddde0a6f45672dd871cba7b3ff28e17",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
|
|
"lessThan": "a6a951416b55eaf51ea2742f7ba786f240e70137",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
|
|
"lessThan": "f5d74c186bab26a5d5a025305e67edd0888aa34d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
|
|
"lessThan": "b56400364aed5c34d6e1a0b493081290a5328a9c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
|
|
"lessThan": "89ca7756d5566ba636bb9092cdbe57dab095e136",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
|
|
"lessThan": "954d196bebb2b50151cb96454c72dc113b2af1ac",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/server/auth.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.114",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.40",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.4",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.12.114"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.18.40"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "7.1.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e589e997bddde0a6f45672dd871cba7b3ff28e17"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a6a951416b55eaf51ea2742f7ba786f240e70137"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f5d74c186bab26a5d5a025305e67edd0888aa34d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac"
|
|
}
|
|
],
|
|
"title": "ksmbd: validate NTLMv2 response before updating session key",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |