ksmbd: free preauth sessions on connection teardown
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauth_session between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates this object and returns STATUS_MORE_PROCESSING_REQUIRED. If the client disconnects before it sends the authenticate request, neither the authenticate nor error cleanup paths free the object. Release any remaining preauthentication sessions when tearing down the connection. Initialize the list when allocating the connection so that this cleanup is safe regardless of the negotiated dialect.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From f5a544e3bab78142207e0242d22442db85ba1eff · fixed in effcf48d79d8aa53113d8289e140746f25ceb62c; From f5a544e3bab78142207e0242d22442db85ba1eff · fixed in b62b1ebb25f0a19067ed5b1a86036b2dc98be44f; From f5a544e3bab78142207e0242d22442db85ba1eff · fixed in a41a98ee16ae038751b6639decadaa3ce15ca18a; From f5a544e3bab78142207e0242d22442db85ba1eff · fixed in 8e2ebc77678832e981adc008d25cd8f67d08ebc4; From f5a544e3bab78142207e0242d22442db85ba1eff · fixed in 06c7b1d731bc105a8644f1b70165ba8b9416cbab
- Linux Linux
5.15
- KernelLinux
From 5.15.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6