oss-security - CVE-2018-1066 : kernel - CIFS - Null pointer dereference in ntlmv2 response client crash.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 6 Mar 2018 14:07:43 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-1066 : kernel - CIFS - Null pointer dereference in ntlmv2
 response client crash.

Gday,

Dan Aloni reported to Red Hat that there was a flaw in the CIFS client
implementation in kernel that could cause a null pointer dereference
and panic the a Linux CIFS client.  It would require the server to
implement the CIFS protocol incorrectly or momentarily impersonate the
CIFS server during session recovery (such as when the server was shut
down, or the network conditions were bad). The attacker would need to
return an empty "TargetInfo" in the NTLMSSP setup negotiation response
causing the null pointer dereference when interpreted by the client.

Report ( and patch )

https://patchwork.kernel.org/patch/10187633/

RedHat Bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=1539599

Thanks,

Wade Mealing
Red Hat Product Security

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.