SMBv3 FileNormalizedNameInformation NULL Pointer Dereference
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 19042.1706, 19043.1706, 19044.1706
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot.
Timeline
- CVE published
- Record last updated
Affected versions
- Microsoft Windows 10 Version 20H2
From 19042.1706 · fixed in 19042.1706; From 19043.1706 · fixed in 19043.1706; From 19044.1706 · fixed in 19043.1706
- Microsoft Windows Server Version 20H2
From 19042.1706 · fixed in 19042.1706; From 19043.1706 · fixed in 19043.1706; From 19044.1706 · fixed in 19044.1706
- Microsoft Windows 10 Version 21H1
From 19042.1706 · fixed in 19042.1706; From 19043.1706 · fixed in 19043.1706; From 19044.1706 · fixed in 19044.1706
- Microsoft Windows 10 Version 21H2
From 19042.1706 · fixed in 19042.1706; From 19043.1706 · fixed in 19043.1706; From 19044.1706 · fixed in 19044.1706