In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix null pointer dereference in proc_show_files()<\/p>\n
When a SMB2 client opens a file with a durable v2 handle and then issues
\nSMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the
\nreconnectable file pointer but leaves the fp registered in global_ft.idr
\nuntil the durable scavenger fires (up to fp->durable_timeout seconds
\nlater).<\/p>\n
During that window any read of \/proc\/fs\/ksmbd\/files (mode 0400) panics
\nthe kernel because proc_show_files() walks global_ft.idr and
\nunconditionally dereferences fp->tcon->id with no NULL guard.<\/p>\n
Reproducer requires only a successful SMB2 SESSION_SETUP and a share
\nconfigured with ‘durable handles = yes’. KASAN report on mainline
\n70390501d194:<\/p>\n
general protection fault, probably for non-canonical address
\n 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
\n RIP: 0010:proc_show_files+0x118\/0x740
\n Call Trace:
\n proc_show_files+0x118\/0x740
\n seq_read_iter+0x4ef\/0xe10
\n proc_reg_read_iter+0x1b7\/0x280
\n …<\/p>\n
Guard the dereference. A durable-disconnected fp legitimately has no
\ntcon; report its tree id as 0 rather than oopsing.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix null pointer dereference in proc_show_files()<\/p>\n
When a SMB2 client opens a file with a durable v2 handle and then issues<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15100","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}