CVE-2024-0565

What it actually does

Out-of-bounds memory read in receive_encrypted_standard caused by integer underflow on memcpy length in the Linux kernel SMB client implementation, resulting in denial of service.

Why it matters to the business

Disrupts file sharing and network storage operations on affected Linux systems and NetApp ONTAP tools deployments, potentially causing service outages and requiring restarts or reboots to recover.

How an attack unfolds

An attacker on the same network segment crafts malicious SMB2 encrypted packets that trigger the integer underflow during receive processing, leading to an out-of-bounds read and kernel crash or hang.

How to fix it

Update to a patched Linux kernel version that addresses the integer underflow in fs/smb/client/smb2ops.c; monitor vendor advisories for NetApp ONTAP tools updates; apply available security patches as soon as released.

How to confirm the fix worked

Verify kernel source or running version no longer contains the vulnerable receive_encrypted_standard path; test SMB client connections with crafted encrypted packets in a lab environment to confirm absence of crash.

Typical attack path

1. Gain adjacent network access to a target Linux SMB client
2. Send specially crafted SMB2 encrypted packets to the client
3. Trigger integer underflow during memcpy length calculation in receive_encrypted_standard
4. Cause out-of-bounds memory read resulting in denial of service

How to detect it

Review kernel logs for oops, panic, or SMB client crash entries around the time of suspected incidents; inspect network traffic for anomalous SMB2 encrypted packet sequences targeting the client.

What your security team should do

• Prioritize kernel updates on all Linux systems acting as SMB clients
• Restrict SMB traffic to trusted networks to reduce attack surface
• Monitor for kernel oops or panic logs related to SMB client processing
• Review and apply vendor patches for NetApp ONTAP tools when available