CVE-2014-7145

High

Published: 28/09/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The SMB2_tcon function in the Linux kernel before version 3.16.3 allows remote CIFS servers to cause a denial of service through NULL pointer dereference, leading to client system crashes. It may also lead to unspecified other impacts by deleting the IPC$ share during DFS referral resolution.

Risk Assessment

Organizations may experience service outages and potential data loss due to client system crashes. Remote attacks could lead to significant disruptions in IT infrastructure operations.

Recommendation

It is recommended to update the Linux kernel to version 3.16.3 or later to mitigate this vulnerability. Additionally, monitoring and securing IPC$ shares may help minimize risk.

Other vulnerabilities in Linux kernel (versions before 3.16.3)

CVE-2014-3631High
The assoc_array_gc function in the associative-array implementation in the Linux kernel before version 3.16.3 does not properly implement garbage collection, which may lead to system crashes or other unspecified impacts.

Original NVD description (English source)

The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.