CVE-2022-0168

What it actually does

The vulnerability causes a denial of service by allowing a local privileged attacker to trigger a kernel crash through incorrect handling of the return value from memdup_user in the smb2_ioctl_query_info function within the CIFS module.

Why it matters to the business

Linux systems using CIFS may experience unexpected crashes, leading to downtime and service interruptions for file sharing operations. The issue affects kernel versions prior to the fix in commit d6f5e358452479fa8a773b5c6ccc9e4ec5a20880.

How an attack unfolds

An attacker with local access and CAP_SYS_ADMIN privileges invokes the smb2_ioctl_query_info function in a way that causes memdup_user to fail incorrectly, resulting in a system crash.

How to fix it

Update the Linux kernel to a version that includes the fix in commit d6f5e358452479fa8a773b5c6ccc9e4ec5a20880 or later.

How to confirm the fix worked

Verify the kernel source includes the commit d6f5e358452479fa8a773b5c6ccc9e4ec5a20880 and test that the smb2_ioctl_query_info function handles memdup_user errors correctly without crashing.

Typical attack path

1. Obtain local access to the target Linux system
2. Acquire CAP_SYS_ADMIN privileges
3. Craft and execute an ioctl call targeting the CIFS smb2_ioctl_query_info function to trigger the flaw

How to detect it

Examine system logs for kernel panics or oops messages involving cifs or smb2_ioctl_query_info; check for unusual CIFS ioctl activity from privileged processes.

What your security team should do

• Apply the kernel patch containing commit d6f5e358452479fa8a773b5c6ccc9e4ec5a20880 immediately on affected systems
• Restrict CAP_SYS_ADMIN privileges to only necessary processes
• Monitor for kernel oops or panic logs related to CIFS