A use-after-free flaw was found in smb2isstatusiotimeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1192.json"
[
{
"id": "CVE-2023-1192-0ec3e136",
"target": {
"function": "wait_for_response",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "218442219753944894432663366639675517272",
"length": 251.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-20027583",
"target": {
"function": "compound_send_recv",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "47487349146872579211739864649227977518",
"length": 4298.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-28d40b35",
"target": {
"function": "__release_mid",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "32381625669649903645881196892226886861",
"length": 1966.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-5676227c",
"target": {
"function": "SendReceiveBlockingLock",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "3187742302934208715260827922469591478",
"length": 2859.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-6e48fb32",
"target": {
"function": "SendReceive",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "67100182376683063203459060422267242207",
"length": 2149.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-7dbdc7ef",
"target": {
"function": "cifs_compound_callback",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "210195164091433668563914884485029032448",
"length": 226.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-8095be05",
"target": {
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281943612746316099753685868188517085984",
"141314236440607895726663964861559368442",
"195742389016092061786969750077728853950",
"87565008577501718359734180880997261133",
"318705560749297585227163663555069469938",
"33468516884825717933402594292532383640",
"175320875343873030869141503041157593279",
"174311298384466700926757822142840182685",
"295215499292180985094145815939227985784",
"234875400614499685866587192805330894001",
"97428576206055534039290941267129251006",
"298946320411583730639582470367796919699",
"22462607251922388412723998454162194590",
"284202138136025774542327547828451597187",
"305633180332462388121036454141786279453",
"133760219783153308811679735773154726471",
"269560360919447152394231045607331161033",
"326461970091435201289855204676643324200",
"293565078263264333075069709304788029077",
"168391007824207561276669507870870200917",
"59471427969084013507279700405962151850",
"177506899188461243410055774609416401045",
"40344347392046432150797077898889849886",
"151858819155820093053494775316371646728",
"161711620457057089788699946532196917420",
"289062675027430741814010070016981697253",
"116020403769005912587846518112892907923",
"289832834886074492591951427780318230031",
"107261575336733435878921665717339712743",
"88946224168648451887091228784828049853",
"117079349840657534868966611802647337638",
"159480275602757058485819907835832620065",
"223210158481492041401197786721805359269",
"332018838235846058781330504809669901440",
"109676243157903566426875392356710134708",
"337331237835138903024410575021739963615",
"143501981324238480801220336661162349895",
"79664298609827546841591186056999396709",
"288225481775934222813751815962123451882",
"120083377330723056714589223843468002787",
"8415307359989884174034846174035645762",
"70212633260052011669273314237391996460",
"326935040345755317789741607098299585438",
"325879840418223450682470695170234982644",
"52282138376662795344884074211805136749",
"97929318871083861033961674262557079822",
"88946224168648451887091228784828049853",
"117079349840657534868966611802647337638",
"176294158912912677163723443302755095394",
"203398221352604153316522932557017112820",
"276372894250127764318182785772737661092",
"16886386872981692633430211900431161278",
"172266720876652057840866321608235176004"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-1192-8b53d587",
"target": {
"function": "cifs_sync_mid_result",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "194865557353650770686665071019479982187",
"length": 830.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-1192-fc280d91",
"target": {
"function": "cifs_wake_up_task",
"file": "fs/smb/client/transport.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@d527f51331cace562393a8038d870b3e9916686f",
"digest": {
"function_hash": "294520042585078727605537488095868788767",
"length": 74.0
},
"signature_type": "Function"
}
]