CVE-2018-1066

What it actually does

NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() triggered by an empty TargetInfo field in an NTLMSSP negotiation response during CIFS session recovery, resulting in kernel panic on the client.

Why it matters to the business

Denial of service that can crash systems accessing network file shares, interrupting operations and requiring reboots with potential data loss in flight.

How an attack unfolds

An attacker hosts a malicious CIFS server configured to send an NTLMSSP setup response containing an empty TargetInfo field. When a vulnerable client mounts the share and performs session recovery, the mishandled field causes the NULL dereference and immediate kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit cabfb3680f78981d26c078a26e5c748531257ebb or later (kernel 4.11+). Restrict CIFS mounts to trusted servers only and avoid mounting untrusted shares.

How to confirm the fix worked

Verify the running kernel is 4.11 or newer and contains the referenced commit. Test exposure by attempting to mount a CIFS share from a server that returns an empty TargetInfo field and confirm no panic occurs.

Typical attack path

1. Deploy a rogue CIFS server that responds to NTLMSSP negotiation with empty TargetInfo
2. Lure or wait for a vulnerable Linux client to mount the share
3. Trigger session recovery on the client (e.g., via network interruption or reconnect)
4. Cause kernel panic and denial of service on the client system

How to detect it

Inspect kernel logs and system crash dumps for oops or panic entries referencing cifsencrypt.c or setup_ntlmv2_rsp after CIFS mount activity. Correlate with network logs showing connections to unexpected CIFS servers.

• setup_ntlmv2_rsp
• fs/cifs/cifsencrypt.c
• NULL pointer dereference.*cifs

What your security team should do

• Apply the kernel update containing commit cabfb3680f78981d26c078a26e5c748531257ebb immediately on all affected systems
• Enforce policy that only trusted CIFS servers may be mounted
• Review and harden CIFS client configurations to reduce exposure to untrusted servers