CVE-2011-3191

Vulnerability

A signedness error exists in the CIFSFindNext function in fs/cifs/cifssmb.c of the Linux kernel before version 3.1. The name_len variable is declared as a signed int, but it is assigned from resume_name_len, an unsigned value that can be controlled by a remote CIFS server. If the server sends an excessively large value, it becomes negative when cast to signed, bypassing the PATH_MAX check. This negative value is then used as the length parameter in a memcpy call, causing memory corruption. [1][2][4]

Exploitation

An attacker operating a malicious CIFS server sends a specially crafted response to a directory read request, setting resume_name_len to a very large 32-bit value. No authentication is required if the client connects to the attacker's server. The client's kernel processes the response, triggering the signedness issue and leading to memory corruption. [2]

Impact

Successful exploitation results in memory corruption, which can cause a denial of service (system crash) or potentially allow arbitrary code execution with kernel privileges. The exact impact depends on the memory layout and the attacker's ability to control the corrupted data. [1][2]

Mitigation

The vulnerability is fixed in Linux kernel version 3.1 via commit 9438fabb73eb48055b58b89fc51e0bc4db22fabd, which changes name_len to an unsigned type. [4] Users should update to kernel 3.1 or later. No workaround is available. The CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.