CVE-2024-46742

What it actually does

Potential null pointer dereference in smb/server smb2_open() when req_op_level is SMB2_OPLOCK_LEVEL_LEASE and parse_lease_state() returns NULL, leading to memory corruption.

Why it matters to the business

Kernel crashes or denial of service on Linux systems exposing SMB file sharing, disrupting services with minimal urgency due to low exploitability and no known campaigns.

How an attack unfolds

An attacker connects to an SMB server and sends a crafted SMB2 OPEN request specifying lease oplock level that triggers parse_lease_state returning NULL, causing null dereference in lease context handling.

How to fix it

Upgrade Linux kernel to commit 878f32878351104448b86ef5b85d1f8ed6f599fb or later; for Docker environments upgrade to version 26.0.2 or newer which incorporates the fix.

How to confirm the fix worked

Verify kernel source contains the added NULL check on lease_ctx_info in smb2_open(); confirm running kernel version includes the referenced commit or apply patch and test SMB2 lease operations.

Typical attack path

1. Establish SMB connection to target server
2. Send SMB2 negotiate and session setup packets
3. Issue SMB2 OPEN request with SMB2_OPLOCK_LEVEL_LEASE and malformed lease state
4. Trigger null dereference in smb2_open() leading to kernel panic

How to detect it

Search kernel logs and SMB server traces for null pointer dereference crashes referencing smb2_open or lease_ctx_info; examine incoming SMB2 packets for lease-level open requests.

What your security team should do

• Apply kernel updates containing the fix as soon as practical for systems running SMB server code
• Review SMB server configurations to limit exposure where possible
• Monitor kernel logs for oops or null pointer dereference messages involving smb2_open