In the Linux kernel, the following vulnerability has been resolved:
cifs: fix DFS traversal oops without CONFIGCIFSDFS_UPCALL
When compiled with CONFIGCIFSDFSUPCALL disabled, cifsdfsdautomount is NULL. cifs.ko logic for mapping CIFSFATTRDFSREFERRAL attributes to SAUTOMOUNT and corresponding dentry flags is retained regardless of CONFIGCIFSDFSUPCALL, leading to a NULL pointer dereference in VFS followautomount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> _traversemounts+0xb5/0x220 ? cifsrevalidatemapping+0x65/0xc0 [cifs] stepinto+0x195/0x610 ? lookupfast+0xe2/0xf0 pathlookupat+0x64/0x140 filenamelookup+0xc2/0x140 ? _createobject+0x299/0x380 ? kmemcachealloc+0x119/0x220 ? userpathatempty+0x31/0x50 userpathatempty+0x31/0x50 _x64syschdir+0x2a/0xd0 ? exittousermodeprepare+0xca/0x100 dosyscall64+0x42/0x90 entrySYSCALL64after_hwframe+0x72/0xdc
This fix adds an inline cifsdfsdautomount() {return -EREMOTE} handler when CONFIGCIFSDFSUPCALL is disabled. An alternative would be to avoid flagging SAUTOMOUNT, etc. without CONFIGCIFSDFSUPCALL. This approach was chosen as it provides more control over the error path.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53246.json"
}[
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
],
"threshold": 0.9
},
"id": "CVE-2023-53246-06246135",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7d854c33ab48e55fc233699bbefe39ec9bb5c05"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
],
"threshold": 0.9
},
"id": "CVE-2023-53246-30e91bca",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e144b68208e98fd4602c842a7149ba5f41d87fb"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
],
"threshold": 0.9
},
"id": "CVE-2023-53246-50071935",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26a32a212bc540f4773cd6af8cf73e967d72569c"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
],
"threshold": 0.9
},
"id": "CVE-2023-53246-a364ab71",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@179a88a8558bbf42991d361595281f3e45d7edfc"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "fs/cifs/cifsfs.h"
},
"signature_type": "Line",
"digest": {
"line_hashes": [
"122609207922613810880629926330282121283",
"270652002713862698729800150884069146723",
"50433171207418939607610931191742459522"
],
"threshold": 0.9
},
"id": "CVE-2023-53246-accae1b1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b64305185b76f1d5145ce594ff48f3f0e70695bd"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53246.json"