The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setupntlmv2rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1066.json"
[
{
"id": "CVE-2018-1066-2587c836",
"signature_type": "Function",
"digest": {
"function_hash": "216954651636131985721808950264695229383",
"length": 877.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"function": "build_ntlmssp_negotiate_blob",
"file": "fs/cifs/sess.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-7254f62f",
"signature_type": "Function",
"digest": {
"function_hash": "13989198568186051141165231270407557005",
"length": 3517.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"function": "build_ntlmssp_auth_blob",
"file": "fs/cifs/sess.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-91a054f2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302522898042074888055369601333158120773",
"135959377716601364429362832708741329987",
"277689944773120786165466542350226825545",
"52556117287328243693838386884059930101",
"2737865347233096332460503702507213514",
"123849823981366394002121152799953552902",
"50269873885361880248382686003568145859",
"164051937561447286600200039114241342850",
"270010505014611906972960745051376254079",
"53752911857675663851480764948032635856",
"138736959277699997929980986715663816596",
"336075477739750832370101186262389677220",
"262328397227107595476995723328379937992",
"270165290646074671601315715819236502004",
"277764119150491272276485804802909778042",
"306828551545934158200577362702726288942",
"141138166957906985237558813584255974984",
"261096300967665416241206075441798929300",
"177542828411188073159457331888750016326",
"125537811298817736247579460395331480540"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"file": "fs/cifs/smb2pdu.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-9f248d87",
"signature_type": "Function",
"digest": {
"function_hash": "44968041478776360791055295900502032226",
"length": 985.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"function": "SMB2_sess_establish_session",
"file": "fs/cifs/smb2pdu.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-c0b1168b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161020820476324950200645462635837778332",
"302662865422417066836562543404647031447",
"141779242191409681629798030187963809247",
"212097462189448046739540712140677307450",
"80310304915008753018131766305832482613",
"333186492900232242575821607409699244890",
"172633900443632893954568226254633321600",
"78301975745498418306684370851307215352",
"306547926493003041187424943180501459318",
"146344606223505883761565932195018658897",
"77946116840916262747440863318598158179",
"303511015468978379690913850681798013809",
"141779242191409681629798030187963809247",
"212097462189448046739540712140677307450",
"80310304915008753018131766305832482613",
"333186492900232242575821607409699244890",
"172633900443632893954568226254633321600",
"291023720254275001497340186601683858867",
"314730484399028022617523717262935870683",
"260491680310899160838975341022345267831"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"file": "fs/cifs/sess.c"
},
"deprecated": false
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1066.json"
[
{
"id": "CVE-2018-1066-21887094",
"signature_type": "Function",
"digest": {
"function_hash": "44968041478776360791055295900502032226",
"length": 985.0
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"function": "SMB2_sess_establish_session",
"file": "fs/cifs/smb2pdu.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-660ecba9",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302522898042074888055369601333158120773",
"135959377716601364429362832708741329987",
"277689944773120786165466542350226825545",
"52556117287328243693838386884059930101",
"2737865347233096332460503702507213514",
"123849823981366394002121152799953552902",
"50269873885361880248382686003568145859",
"164051937561447286600200039114241342850",
"270010505014611906972960745051376254079",
"53752911857675663851480764948032635856",
"138736959277699997929980986715663816596",
"336075477739750832370101186262389677220",
"262328397227107595476995723328379937992",
"270165290646074671601315715819236502004",
"277764119150491272276485804802909778042",
"306828551545934158200577362702726288942",
"141138166957906985237558813584255974984",
"261096300967665416241206075441798929300",
"177542828411188073159457331888750016326",
"125537811298817736247579460395331480540"
]
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"file": "fs/cifs/smb2pdu.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-df111f76",
"signature_type": "Function",
"digest": {
"function_hash": "13989198568186051141165231270407557005",
"length": 3517.0
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"function": "build_ntlmssp_auth_blob",
"file": "fs/cifs/sess.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-df6da87b",
"signature_type": "Function",
"digest": {
"function_hash": "216954651636131985721808950264695229383",
"length": 877.0
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"function": "build_ntlmssp_negotiate_blob",
"file": "fs/cifs/sess.c"
},
"deprecated": false
},
{
"id": "CVE-2018-1066-ef5aacc8",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161020820476324950200645462635837778332",
"302662865422417066836562543404647031447",
"141779242191409681629798030187963809247",
"212097462189448046739540712140677307450",
"80310304915008753018131766305832482613",
"333186492900232242575821607409699244890",
"172633900443632893954568226254633321600",
"78301975745498418306684370851307215352",
"306547926493003041187424943180501459318",
"146344606223505883761565932195018658897",
"77946116840916262747440863318598158179",
"303511015468978379690913850681798013809",
"141779242191409681629798030187963809247",
"212097462189448046739540712140677307450",
"80310304915008753018131766305832482613",
"333186492900232242575821607409699244890",
"172633900443632893954568226254633321600",
"291023720254275001497340186601683858867",
"314730484399028022617523717262935870683",
"260491680310899160838975341022345267831"
]
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb",
"target": {
"file": "fs/cifs/sess.c"
},
"deprecated": false
}
]