ksmbd: fix null pointer dereference in alloc_preauth_hash()
Linux · Linux
The ksmbd in-kernel SMB server component of the Linux kernel contains a null pointer dereference in alloc_preauth_hash(), which is reached when a client sends a malformed SMB2 negotiate request and then proceeds to a session setup request before preauth state has been allocated. A remote, unauthenticated attacker with network access to the SMB service can trigger this condition without user interaction or special configuration, causing a denial of service (availability impact).
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 16 Apr 2025. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.