CVE-2024-53185

Summary

CVE-2024-53185: A NULL pointer dereferencing vulnerability has been identified in the Linux kernel's crypto_aead_setkey() function, specifically in the smb subsystem. This issue arises from an incorrect check in the commit b0abcd65ec54, which always returns false for SMB3.02, leading to the use of an unset @server->cipher_type and subsequent NULL pointer dereference. The vulnerability can occur during the mounting of a CIFS share using the vers=3.02 option. Exploitation of this vulnerability may lead to a kernel crash or potential escalation of privileges. Users are advised to update their Linux kernel to resolve this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.