Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - cifs防止 smb2_ioctl_query_info() 中出現錯誤的輸出長度。當以 smb_query_info::flags=PASSTHRU_FSCTL and smb_query_info::output_buffer_length=0 呼叫 smb2_ioctl_query_info() 時下列程式會傳回 0x10 buffer = memdup_user(arg + sizeof(struct smb_query_info), qi。 output_buffer_length); if (IS_ERR(buffer)) { kfree(vars); return PTR_ERR(buffer);而不是有效的指標因而造成 IS_ERR() 檢查失敗。這會造成稍後在 smb2_ioctl_query_ioctl() 中存取 @buffer 時發生 NULL 指標解除參照。同時防止 @buffer 小於 8 位元組以便在 smb_query_info::flags=PASSTHRU_SET_INFO 時正確處理 SMB2_SET_INFO FileEndOfFileInformation 要求。小型 C 複製器會在傳遞無效的 smb_query_info::flags 時觸發 @buffer 中的 NULL 指標 #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <unistd.h> #include <fcntl.h> #include<sys/ioctl.h> #define die(s) perror(s)、exit(1) #define QUERY_INFO 0xc018cf07 int main(int argc, char
    *argv[]) { int fd; if (argc < 2) exit(1); fd = open(argv[1], O_RDONLY); if (fd == -1) die(open); if (ioctl(fd, QUERY_INFO, (uint32_t[]) { 0, 0, 0, 4, 0, 0}) == -1) die(ioctl); close(fd);傳回 0 } mount.cifs //srv/share /mnt -o ... gcc repro.c && ./a.out /mnt/f0 [ 114.138620] 一般保護錯誤可能是非正式位址 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 114.139310] KASANnull-ptr-deref 範圍 [0x0000000000000000-0x0000000000000007] [ 114.139775] CPU2 PID995 通訊
    a.out 未受污染的 5.17.0-rc8 #1 [ 114.140148] 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01 /2014 [ 114.140818] RIP
    0010:smb2_ioctl_query_info+0x206/0x410 [cifs] [ 114.141221] 程式碼00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c8 01 00 00 48 b8 00 00 00 00 00 fc ff df 4b 7b 28 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9c 01 00 00 49 8b 3f e8 58 02 fb ff 48 8b 14 24 [ 114.142348] RSP0018:ffffc90000b47b00 EFLAGS000102560] RAX0 [000102560 114.142692000102560] 000102560 [ RBXffff888115503200 RCXfffffffa020580d [ 114.143119] RDX
    0000000000000000 RSI0000000000000004 RDIfffffffa043a380 [ 114.143544] RBPffff888115503278 R08
    0000000000000001 R090000000000000003 [ 114.143983] R10fffffbfff4087470 R110000000000000001 R12
    ffff888115503288 [ 114.144424] R13: 00000000ffffffea R14: ffff888115503228 R15: 0000000000000000 [114.144852] FS: 00007f7aeabdf740(0000) GS:ffff888151600000(0000) knlGS:0000000000000000 [ 114.145338] CS:
    0010 DS 0000 ES 0000 CR0 0000000080050033 [ 114.145692] CR2 00007f7aeacfdf5e CR3 000000012000e000 CR4 0000000000350ee0 [ 114.146131] 呼叫追踪 [ 114.146291] <TASK> [ 114.146432] ? smb2_query_reparse_tag+0x890/0x890 [cifs] [ 114.146800] ? cifs_mapchar+0x460/0x460 [cifs] [ 114.147121] rcu_read_lock_sched_held+0x3f/0x70 [ 114.147412] ? cifs_strndup_to_utf16+0x15b/0x250 [cifs] [ 114.147775] dentry_path_raw+0xa6/0xf0 [ 114.148024] ? cifs_convert_path_to_utf16+0x198/0x220 [cifs] [ 114.148413] ? smb2_check_message+0x1080/0x1080 [cifs] [ 114.148766] ? rcu_read_lock_sched_held+0x3f/0x70 [ 114.149065] cifs_ioctl+0x1577/0x3320 [cifs] [ 114.149371] ? lock_downgrade+0x6f0/0x6f0 [ 114.149631] ? cifs_readdir+0x2e60/0x2e60 [cifs] [ 114.149956] rcu_read_lock_sched_held+0x3f/0x70 [ 114.150250] ?
    __rseq_handle_notify_resume+0x80b/0xbe0 [ 114.150562] ? __up_read+0x192/0x710 [ 114.150791] ?
    __ia32_sys_rseq+0xf0/0xf0 [ 114.151025] ? __x64_sys_openat+0x11f/0x1d0 [ 114.151296]
    __x64_sys_ioctl+0x127/0x190 [ 114.151549] do_syscall_64+0x3b/0x90 [ 114.151768] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 114.152079] RIP 0033:0x7f7aead043df [ 114.152306] 代碼00 48 89 44 24 1844 31c44888d 60 c7 04 24 ---truncated--- (CVE-2022-49271)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2022-49271

medium Nessus Plugin ID 225523

版本 1.13