CVE-2024-49996

What it actually does

The vulnerability is a buffer overflow in the Linux kernel CIFS driver caused by cifs_strndup_from_utf16 accessing buf->DataBuffer without subtracting InodeType size from ReparseDataLength and by missing size checks before accessing InodeType or calling reparse_mkdev.

Why it matters to the business

Systems using CIFS mounts may experience crashes or allow local attackers to read or write kernel memory, resulting in loss of system integrity or availability on Linux hosts that handle NFS reparse points.

How an attack unfolds

An attacker supplies a crafted reparse point via a CIFS share or local mount; the kernel parses ReparseDataLength without the required subtraction or size guard, causing out-of-bounds read or write that can be leveraged for privilege escalation.

How to fix it

Apply the upstream fix in commit 7b222d6cb87077faf56a687a72af1951cf78c8a9 or upgrade to a kernel containing that change; for Rocky Linux 8 packages update libecap to 1.0.1-2.module+el8.4.0+404+316a0dc5 and squid to 4.11-4.module+el8.4.0+404+316a0dc5.2.

How to confirm the fix worked

Confirm the running kernel contains commit 7b222d6cb87077faf56a687a72af1951cf78c8a9, then exercise CIFS reparse point parsing with both small and large buffers to verify correct size handling and absence of invalid memory accesses.

Typical attack path

1. Obtain local access or ability to mount a CIFS share on the target
2. Prepare a reparse point buffer with ReparseDataLength set to bypass InodeType size
3. Trigger CIFS reparse point parsing through file operations or directory listing
4. Exploit resulting out-of-bounds access for code execution or denial of service

How to detect it

Inspect kernel logs for cifs module oops or panic entries mentioning reparse points or DataBuffer; correlate with CIFS mount activity and look for processes triggering unexpected memory faults in the cifs code path.

What your security team should do

• Patch affected Linux kernels immediately on systems that mount CIFS shares
• Limit CIFS mounts to trusted servers and restrict reparse point usage where possible
• Review logs for cifs-related oops or invalid memory access events