CVE-2022-50859

Root

Cause

A mistake in the Linux kernel's CIFS implementation caused the VALIDATE_NEGOTIATE_INFO message to be longer than expected. Commit d5c7076b772a extended the supported SMB dialects from 3 to 4, but failed to adjust the extended length field accordingly. This resulted in a message of 28 bytes instead of the correct 26 bytes, with the extra bytes left uninitialized [1][2].

Exploitation

An attacker on the same network segment could potentially intercept or trigger the exchange of a VALIDATE_NEGOTIATE_INFO message. Because the message body is not initialized, the extra bytes may contain kernel heap memory, which could be read by the attacker. No authentication is required, as this occurs during the SMB protocol negotiation phase.

Impact

Successful exploitation leads to an information disclosure vulnerability. An attacker could gain insights into kernel memory contents, potentially exposing sensitive data such as cryptographic keys, credentials, or other confidential information.

Mitigation

The fix reduces the message length to 26 bytes, ensuring that the entire message is properly initialized. The stable kernel commits [1][2] apply the correction. Users should update their kernel to a version containing this patch.