CVE-2022-49271 is a vulnerability identified in the Linux kernel's CIFS (Common Internet File System) client implementation, specifically within the smb2_ioctl_query_info() function. The flaw arises when the function is called with smb_query_info::flags set to PASSTHRU_FSCTL and smb_query_info::output_buffer_length set to zero. Under these conditions, the function attempts to duplicate a user-space buffer of zero length using memdup_user(), which returns an error pointer rather than a valid pointer. However, the subsequent IS_ERR() check fails to detect this error, leading to a NULL pointer dereference when the code later accesses the buffer. This results in a kernel crash (general protection fault) due to dereferencing a NULL pointer. Additionally, the vulnerability includes improper handling of buffers smaller than 8 bytes when processing SMB2_SET_INFO FileEndOfFileInformation requests with the PASSTHRU_SET_INFO flag, which could also lead to instability or memory corruption. The vulnerability can be triggered by issuing a crafted ioctl call (QUERY_INFO) on a mounted CIFS share, as demonstrated by the provided C reproducer code. The kernel logs show a general protection fault and a KASAN (Kernel Address Sanitizer) null pointer dereference, confirming the impact. This vulnerability affects Linux kernel versions containing the vulnerable CIFS code and can be exploited locally by users with access to a CIFS-mounted filesystem. The flaw does not require elevated privileges beyond the ability to perform ioctl calls on CIFS mounts, but it can cause denial of service by crashing the kernel. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The issue has been resolved in recent kernel updates by adding proper checks to prevent invalid buffer lengths and ensure error pointers are correctly handled.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with vulnerable CIFS client implementations, especially those that mount SMB/CIFS shares from Windows or Samba servers. The impact is mainly denial of service (DoS) through kernel crashes triggered by malformed ioctl calls. This can disrupt critical file sharing services, affecting business continuity, especially in environments relying on CIFS for network storage or cross-platform file access. Organizations using Linux-based servers, workstations, or embedded devices that access SMB shares are at risk. While the vulnerability does not appear to allow privilege escalation or remote code execution, the resulting kernel panic can lead to system downtime and potential data loss if unsaved data is present. In multi-tenant or virtualized environments, a single compromised or malicious user with access to CIFS mounts could disrupt the host system or other tenants. Given the widespread use of Linux in European enterprises, cloud providers, and public sector infrastructure, the vulnerability could have significant operational impact if exploited. However, exploitation requires local access and the ability to perform ioctl calls on CIFS mounts, limiting the attack surface to authenticated or internal users. The absence of known exploits in the wild reduces immediate risk but does not eliminate the need for prompt remediation.

European organizations should prioritize updating Linux kernels to versions where this vulnerability is patched. Kernel updates from trusted distributions (e.g., Debian, Ubuntu, Red Hat, SUSE) should be applied promptly. As a temporary mitigation, restrict access to CIFS mounts and limit ioctl operations to trusted users only. Implement strict access controls and monitoring on systems exposing CIFS shares to prevent unauthorized local access. Employ kernel hardening features such as Kernel Address Sanitizer (KASAN) and kernel lockdown where feasible to detect and mitigate memory errors. Network segmentation can reduce exposure by isolating CIFS clients from untrusted networks. Additionally, auditing and monitoring kernel logs for signs of crashes or suspicious ioctl calls can help detect attempted exploitation. For environments using CIFS heavily, consider alternative file sharing protocols or hardened SMB clients until patches are applied. Finally, ensure backups and disaster recovery plans are in place to minimize impact from potential DoS incidents caused by kernel crashes.