Executive Summary

This vulnerability exists in the Linux kernel's SMB client code, specifically in the function cifs_sanitize_prepath. When this function is called with an empty string or a string containing only delimiters such as "/", it attempts to read memory before the start of the string, causing an out-of-bounds read.

The issue arises because the code checks the character before the current cursor position without ensuring the cursor has advanced, leading to invalid memory access.

The fix involves adding an early exit after removing leading delimiters; if no valid path content remains, the function returns NULL to prevent the out-of-bounds read.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to perform an out-of-bounds read, which may lead to a segmentation fault (SEGV) and crash the affected system or process.

Such crashes can result in denial of service conditions, potentially disrupting normal operations that rely on SMB client functionality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a segmentation fault (SEGV) on affected inputs.

There are no specific commands or network detection methods provided to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by a patch that adds an early exit check in the cifs_sanitize_prepath function to prevent out-of-bounds reads.

Immediate mitigation steps would include updating the Linux kernel to a version that includes this patch.

Useful 0 Not Useful 0