{"id":"CVE-2021-46960","state":"PUBLISHED","title":"cifs: Return correct error code from smb2_get_enc_key","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Return correct error code from smb2_get_enc_key\n\nAvoid a warning if the error percolates back up:\n\n[440700.376476] CIFS VFS: \\\\otters.example.com crypt_message: Could not get encryption key\n[440700.386947] ------------[ cut here ]------------\n[440700.386948] err = 1\n[440700.386977] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70\n...\n[440700.397304] CPU: 11 PID: 2733 Comm: tar Tainted: G           OE     5.4.0-70-generic #78~18.04.1-Ubuntu\n...\n[440700.397334] Call Trace:\n[440700.397346]  __filemap_set_wb_err+0x1a/0x70\n[440700.397419]  cifs_writepages+0x9c7/0xb30 [cifs]\n[440700.397426]  do_writepages+0x4b/0xe0\n[440700.397444]  __filemap_fdatawrite_range+0xcb/0x100\n[440700.397455]  filemap_write_and_wait+0x42/0xa0\n[440700.397486]  cifs_setattr+0x68b/0xf30 [cifs]\n[440700.397493]  notify_change+0x358/0x4a0\n[440700.397500]  utimes_common+0xe9/0x1c0\n[440700.397510]  do_utimes+0xc5/0x150\n[440700.397520]  __x64_sys_utimensat+0x88/0xd0","publishedAt":"2024-02-27T18:46:59.919Z","updatedAt":"2026-08-05T08:45:14.917Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"e94851629c49c65b4fbb29a5725ddfd7988f8f20","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"e486f8397f3f14a7cadc166138141fdb14379a54","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"93f3339b22ba17e66f0808737467b70ba087eaec","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"aaa0faa5c28a91c362352d6b35dc3ed10df56fb0","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"f59a9242942fef0de7b926e438ba4eae65d4b4dd","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"b399c1a3ea0b9d10047ff266d65533df7f15532f","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"83728cbf366e334301091d5b808add468ab46b27","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/smb2ops.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.11","versionType":"semver"},{"version":"4.14.233","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.191","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.118","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.36","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.11.20","status":"unaffected","lessThanOrEqual":"5.11.*","versionType":"semver"},{"version":"5.12.3","status":"unaffected","lessThanOrEqual":"5.12.*","versionType":"semver"},{"version":"5.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/smb2ops.c"]}],"references":["https://git.kernel.org/stable/c/e94851629c49c65b4fbb29a5725ddfd7988f8f20","https://git.kernel.org/stable/c/e486f8397f3f14a7cadc166138141fdb14379a54","https://git.kernel.org/stable/c/93f3339b22ba17e66f0808737467b70ba087eaec","https://git.kernel.org/stable/c/aaa0faa5c28a91c362352d6b35dc3ed10df56fb0","https://git.kernel.org/stable/c/f59a9242942fef0de7b926e438ba4eae65d4b4dd","https://git.kernel.org/stable/c/b399c1a3ea0b9d10047ff266d65533df7f15532f","https://git.kernel.org/stable/c/83728cbf366e334301091d5b808add468ab46b27"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:16.371Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/46xxx/CVE-2021-46960.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-46960","state":"PUBLISHED","datePublished":"2024-02-27T18:46:59.919Z","dateUpdated":"2026-08-05T08:45:14.917Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-27T18:42:55.941Z"},"containers":{"cna":{"title":"cifs: Return correct error code from smb2_get_enc_key","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Return correct error code from smb2_get_enc_key\n\nAvoid a warning if the error percolates back up:\n\n[440700.376476] CIFS VFS: \\\\otters.example.com crypt_message: Could not get encryption key\n[440700.386947] ------------[ cut here ]------------\n[440700.386948] err = 1\n[440700.386977] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70\n...\n[440700.397304] CPU: 11 PID: 2733 Comm: tar Tainted: G           OE     5.4.0-70-generic #78~18.04.1-Ubuntu\n...\n[440700.397334] Call Trace:\n[440700.397346]  __filemap_set_wb_err+0x1a/0x70\n[440700.397419]  cifs_writepages+0x9c7/0xb30 [cifs]\n[440700.397426]  do_writepages+0x4b/0xe0\n[440700.397444]  __filemap_fdatawrite_range+0xcb/0x100\n[440700.397455]  filemap_write_and_wait+0x42/0xa0\n[440700.397486]  cifs_setattr+0x68b/0xf30 [cifs]\n[440700.397493]  notify_change+0x358/0x4a0\n[440700.397500]  utimes_common+0xe9/0x1c0\n[440700.397510]  do_utimes+0xc5/0x150\n[440700.397520]  __x64_sys_utimensat+0x88/0xd0"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"e94851629c49c65b4fbb29a5725ddfd7988f8f20","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"e486f8397f3f14a7cadc166138141fdb14379a54","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"93f3339b22ba17e66f0808737467b70ba087eaec","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"aaa0faa5c28a91c362352d6b35dc3ed10df56fb0","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"f59a9242942fef0de7b926e438ba4eae65d4b4dd","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"b399c1a3ea0b9d10047ff266d65533df7f15532f","versionType":"git"},{"version":"61cfac6f267dabcf2740a7ec8a0295833b28b5f5","status":"affected","lessThan":"83728cbf366e334301091d5b808add468ab46b27","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/smb2ops.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.11","versionType":"semver"},{"version":"4.14.233","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.191","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.118","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.36","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.11.20","status":"unaffected","lessThanOrEqual":"5.11.*","versionType":"semver"},{"version":"5.12.3","status":"unaffected","lessThanOrEqual":"5.12.*","versionType":"semver"},{"version":"5.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/smb2ops.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e94851629c49c65b4fbb29a5725ddfd7988f8f20"},{"url":"https://git.kernel.org/stable/c/e486f8397f3f14a7cadc166138141fdb14379a54"},{"url":"https://git.kernel.org/stable/c/93f3339b22ba17e66f0808737467b70ba087eaec"},{"url":"https://git.kernel.org/stable/c/aaa0faa5c28a91c362352d6b35dc3ed10df56fb0"},{"url":"https://git.kernel.org/stable/c/f59a9242942fef0de7b926e438ba4eae65d4b4dd"},{"url":"https://git.kernel.org/stable/c/b399c1a3ea0b9d10047ff266d65533df7f15532f"},{"url":"https://git.kernel.org/stable/c/83728cbf366e334301091d5b808add468ab46b27"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - smb2_get_enc_key runs in the CIFS/SMB3 client demultiplex path on transform PDUs from a remote TCP peer; a malicious or compromised SMB server can send a large encrypted PDU with an unknown SessionId and drive the buggy positive return over the network.\nAC:L - The server fully controls SessionId and PDU size, so key lookup failure and the subsequent positive error return are deterministic with no race or other condition outside the attacker’s control.\nPR:N - The remote SMB peer needs no credentials or privileges on the client; transform receive and smb2_get_enc_key perform no capability checks before the bad return.\nUI:N - Once an SMB3 mount exists (common fstab/automount deployment), the server triggers the bug solely by sending crafted transform responses with no further victim action.\nS:U - Impact is confined to the client kernel’s SMB stack and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The flaw is a wrong positive errno that leads to a NULL dereference / WARN path; it does not provide a memory-disclosure primitive.\nI:N - There is no attacker-controlled write or memory corruption—only mis-handled error return leading to crash/WARN—so integrity is unaffected.\nA:H - Returning 1 is treated as success by cifs_demultiplex_thread (which only rejects length < 0), so receive_encrypted_read failure leaves num_mids=1 with NULL mid/buf and hits smb2_add_credits_from_hdr/cifs_dump_mem NULL derefs (kernel oops); the encrypt/writeback path also WARNs in errseq_set and panics under panic_on_warn."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:45:14.917Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"4.14.233"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"4.19.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"5.4.118"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"5.10.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"5.11.20"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"5.12.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"5.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/e94851629c49c65b4fbb29a5725ddfd7988f8f20","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e486f8397f3f14a7cadc166138141fdb14379a54","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/93f3339b22ba17e66f0808737467b70ba087eaec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/aaa0faa5c28a91c362352d6b35dc3ed10df56fb0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f59a9242942fef0de7b926e438ba4eae65d4b4dd","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b399c1a3ea0b9d10047ff266d65533df7f15532f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/83728cbf366e334301091d5b808add468ab46b27","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:17:42.896Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-46960","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:01:38.257820Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:48.204Z"}}]}}}