Description
A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
linux
Default version status: unaffected
0 to < 5.15.145affected6.0.0 to < 6.0.*affected6.1.0 to < 6.1.29affected6.2.0 to < 6.2.16affected6.3.0 to < 6.3.2affected
Red Hat Red Hat Enterprise Linux 10
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 6
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: unaffected