CVE-2024-46795

What it actually does

Null pointer dereference in ksmbd when a reused SMB connection retains the binding mark, leaving sess->Preauth_HashValue NULL and causing crypto_shash_update to fault during ksmbd_gen_smb311_encryptionkey.

Why it matters to the business

Kernel crash and denial of service on Linux systems exposing the ksmbd SMB server; low urgency as the issue is not under active exploitation or ransomware campaigns and downstream prevalence is limited to specific kernel builds.

How an attack unfolds

An attacker establishes an SMB connection, reuses it for a binding session setup request via cifs.ko or similar, and triggers the path where generate_preauth_hash is skipped, resulting in a NULL hash being passed to the encryption key routine and a kernel NULL pointer dereference.

How to fix it

Upgrade the Linux kernel to a version containing commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1; apply the fix that unsets the binding mark on reused connections before handling session setup.

How to confirm the fix worked

Verify the running kernel contains commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1 or later; confirm conn->binding is cleared on connection reuse and test session setup paths with cifs clients.

Typical attack path

1. Locate Linux host running ksmbd
2. Establish initial SMB connection
3. Reuse the connection for a binding session setup
4. Send NTLM authenticate request that invokes ksmbd_gen_smb311_encryptionkey
5. Trigger NULL dereference in sha256 crypto code

How to detect it

Search kernel logs and crash dumps for oops signatures containing lib_sha256_base_do_update, ksmbd_gen_smb311_encryptionkey, handle_ksmbd_work, and null pointer dereference during smb2_sess_setup; correlate with SMB traffic involving session binding on reused connections.

• BUG: kernel NULL pointer dereference, address: 0000000000000000
• RIP: lib_sha256_base_do_update.isra.0
• Workqueue: ksmbd-io handle_ksmbd_work [ksmbd]
• ksmbd_gen_smb311_encryptionkey
• crypto_shash_update+0x1e/0x40

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all systems running ksmbd
• Disable ksmbd module if SMB server functionality is not required
• Monitor kernel logs for NULL pointer dereference oops involving ksmbd and sha256_ssse3
• Review EPSS trend (stable at 0.0027) and absence from KEV for prioritization