Описание
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix missing credit release on failure in cifs_issue_read()
Fix missing release of credits in the failure path in cifs_issue_read()
lest retrying the subreq just overwrites the credits value.
A flaw was found in the CIFS (Common Internet File System) component of the Linux kernel. A missing credit release on failure in the cifs_issue_read() function can lead to a situation where retrying a sub-request overwrites existing credit values. This resource management issue could potentially lead to system instability or a denial of service.
Отчет
A moderate-impact flaw was found in the CIFS client of the Linux kernel (fs/smb/client/file.c). When a read subrequest issued through cifs_issue_read() fails, the SMB credits acquired for that read are not released before the failed subrequest is terminated; retrying the read then simply overwrites the stored credits value, leaking the previously acquired credits. Repeated read failures and retries on a mounted CIFS share can progressively exhaust the credit accounting for the SMB session, stalling further reads or other I/O against the share and causing a denial of service. Only availability is impacted; there is no impact on confidentiality or integrity. Exploitation requires an existing CIFS mount and read activity that exercises the failure and retry path, for example read failures induced by a misbehaving or compromised remote SMB server. The kernel package in Red Hat Enterprise Linux 10 is affected, and the fix has been deferred to a future update because the flaw is of moderate, availability-only impact; the residual risk of this deferral is a potential denial of service on systems whose CIFS reads repeatedly exercise the failure path. The kernel and kernel-rt packages in Red Hat Enterprise Linux 6, 7, 8, and 9, and the kernel packages in Red Hat In-Vehicle OS, are not affected because the vulnerable code, introduced upstream in the 6.10 kernel development cycle, is not present in those versions. Red Hat rates this flaw as moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the cve.org rating of important (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), because reliable triggering depends on client-side conditions such as an existing CIFS mount and local read activity exercising the failure and retry path, rather than an unauthenticated remote attack.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.
In the Linux kernel, the following vulnerability has been resolved: c ...
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs_issue_read() Fix missing release of credits in the failure path in cifs_issue_read() lest retrying the subreq just overwrites the credits value.
EPSS
5.5 Medium
CVSS3