In the Linux kernel, the following vulnerability has been resolved:
cifs: fix DFS traversal oops without CONFIGCIFSDFS_UPCALL
When compiled with CONFIGCIFSDFSUPCALL disabled, cifsdfsdautomount is NULL. cifs.ko logic for mapping CIFSFATTRDFSREFERRAL attributes to SAUTOMOUNT and corresponding dentry flags is retained regardless of CONFIGCIFSDFSUPCALL, leading to a NULL pointer dereference in VFS followautomount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> _traversemounts+0xb5/0x220 ? cifsrevalidatemapping+0x65/0xc0 [cifs] stepinto+0x195/0x610 ? lookupfast+0xe2/0xf0 pathlookupat+0x64/0x140 filenamelookup+0xc2/0x140 ? _createobject+0x299/0x380 ? kmemcachealloc+0x119/0x220 ? userpathatempty+0x31/0x50 userpathatempty+0x31/0x50 _x64syschdir+0x2a/0xd0 ? exittousermodeprepare+0xca/0x100 dosyscall64+0x42/0x90 entrySYSCALL64after_hwframe+0x72/0xdc
This fix adds an inline cifsdfsdautomount() {return -EREMOTE} handler when CONFIGCIFSDFSUPCALL is disabled. An alternative would be to avoid flagging SAUTOMOUNT, etc. without CONFIGCIFSDFSUPCALL. This approach was chosen as it provides more control over the error path.
[
{
"id": "CVE-2023-53246-06246135",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7d854c33ab48e55fc233699bbefe39ec9bb5c05",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-1836428b",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cd7dbc9c46d51e00a0a8372e07cc1cbb8d24a77",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-30e91bca",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e144b68208e98fd4602c842a7149ba5f41d87fb",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-50071935",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26a32a212bc540f4773cd6af8cf73e967d72569c",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-8603b8f2",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@657d7c215ca974d366ab1808213f716e1e3aa950",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-a364ab71",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@179a88a8558bbf42991d361595281f3e45d7edfc",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-accae1b1",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b64305185b76f1d5145ce594ff48f3f0e70695bd",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2023-53246-fe36387e",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8afb1fabcec1929db46977e84baeee0cc0e79242",
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
}
]