CIFS Vulnerability in Linux Kernel Affects Multiple Versions

CVE-2023-53246

What is CVE-2023-53246?

A vulnerability in the CIFS component of the Linux kernel can lead to a NULL pointer dereference when the CONFIG_CIFS_DFS_UPCALL option is disabled. This condition allows for a potential crash during DFS traversal, specifically when handling CIFS_FATTR_DFS_REFERRAL attributes. The flaw is caused by the logic that retains mapping for these attributes regardless of the configuration option, thereby triggering a NULL pointer dereference when traversing DFS referral links. A fix has been implemented to introduce an inline handler, thereby enhancing control over the error handling during these operations.

References