In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix race condition between session lookup and expire
Thread A + Thread B ksmbdsessionlookup | smb2sesssetup sess = xaload | | | xaerase(&conn->sessions, sess->id); | | ksmbdsessiondestroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | +
This patch add rwsem to fix race condition between ksmbdsessionlookup and ksmbdexpiresession.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"file": "fs/smb/server/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-05740629",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"252524027815073663692002385871168158663",
"82328129303843633043589625901927016387",
"296142333542938733895864474501054856008"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"function": "ksmbd_session_lookup",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-09a70f2f",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 179.0,
"function_hash": "307943634417739052779001988056417751553"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-1b572427",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234587098725212943176763636331141359898",
"68383661627462405998191372053053193609",
"323478462478020166777867526287523874916",
"288225700492177278517742297972536158448",
"292157172241465583806401664140614998807",
"171958618104158434961741324265801593183",
"37930091718922167086027892884249858790",
"135675749795588602641140529107201776344",
"250594591575556118992363477885586059022",
"236118458327971990833704921425605449285",
"60898456291115530969563006027471581376",
"141361052584661155793877436255283841262",
"21102874963313364425952669606991495137",
"171958618104158434961741324265801593183",
"91707608552749299602694532399748668343",
"173181745393294593844423028850518900886",
"33090303761939815461658570703313545360",
"173880521449037069779885989482883441940",
"251225104820449925102918327637528316335",
"242233283779809593337628517108706199919",
"236267346341428878917434510896722954490",
"275239638765666631943667954404628141082"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"function": "ksmbd_sessions_deregister",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-1f421ab2",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 772.0,
"function_hash": "285334952914436883506604738373657733255"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"function": "ksmbd_expire_session",
"file": "fs/ksmbd/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-2064e495",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 426.0,
"function_hash": "169289787749274448659710595622096690147"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"file": "fs/smb/server/connection.h"
},
"deprecated": false,
"id": "CVE-2023-52480-21fdcbb8",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100710795064833837170007297861538503093",
"103229390639720184474358168445166648129",
"325866876888009703726374562446207204757",
"205669141726308613811282138419252683958"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"file": "fs/ksmbd/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-351fdddc",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"252524027815073663692002385871168158663",
"82328129303843633043589625901927016387",
"296142333542938733895864474501054856008"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"function": "ksmbd_sessions_deregister",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-390c4f22",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 772.0,
"function_hash": "285334952914436883506604738373657733255"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"file": "fs/smb/server/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-3af620c3",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"252524027815073663692002385871168158663",
"82328129303843633043589625901927016387",
"296142333542938733895864474501054856008"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"file": "fs/smb/server/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-4a9b366d",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"252524027815073663692002385871168158663",
"82328129303843633043589625901927016387",
"296142333542938733895864474501054856008"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"file": "fs/ksmbd/connection.h"
},
"deprecated": false,
"id": "CVE-2023-52480-58651dff",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100710795064833837170007297861538503093",
"103229390639720184474358168445166648129",
"325866876888009703726374562446207204757",
"205669141726308613811282138419252683958"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"file": "fs/smb/server/connection.h"
},
"deprecated": false,
"id": "CVE-2023-52480-5d3bbbd1",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100710795064833837170007297861538503093",
"103229390639720184474358168445166648129",
"325866876888009703726374562446207204757",
"205669141726308613811282138419252683958"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"function": "ksmbd_conn_alloc",
"file": "fs/smb/server/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-67859a41",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1098.0,
"function_hash": "138347730360154822867571711041019119697"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"function": "ksmbd_conn_alloc",
"file": "fs/smb/server/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-7415b8b7",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1098.0,
"function_hash": "138347730360154822867571711041019119697"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"function": "ksmbd_sessions_deregister",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-7c643e2f",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 772.0,
"function_hash": "285334952914436883506604738373657733255"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-7f1bbaf6",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234587098725212943176763636331141359898",
"68383661627462405998191372053053193609",
"323478462478020166777867526287523874916",
"288225700492177278517742297972536158448",
"292157172241465583806401664140614998807",
"171958618104158434961741324265801593183",
"37930091718922167086027892884249858790",
"135675749795588602641140529107201776344",
"250594591575556118992363477885586059022",
"236118458327971990833704921425605449285",
"60898456291115530969563006027471581376",
"141361052584661155793877436255283841262",
"21102874963313364425952669606991495137",
"171958618104158434961741324265801593183",
"91707608552749299602694532399748668343",
"173181745393294593844423028850518900886",
"33090303761939815461658570703313545360",
"173880521449037069779885989482883441940",
"251225104820449925102918327637528316335",
"242233283779809593337628517108706199919",
"236267346341428878917434510896722954490",
"275239638765666631943667954404628141082"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"function": "ksmbd_expire_session",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-9d79ba13",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 426.0,
"function_hash": "169289787749274448659710595622096690147"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"function": "ksmbd_conn_alloc",
"file": "fs/smb/server/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-a29c26a8",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1098.0,
"function_hash": "138347730360154822867571711041019119697"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-afc110a1",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234587098725212943176763636331141359898",
"68383661627462405998191372053053193609",
"323478462478020166777867526287523874916",
"288225700492177278517742297972536158448",
"292157172241465583806401664140614998807",
"171958618104158434961741324265801593183",
"37930091718922167086027892884249858790",
"135675749795588602641140529107201776344",
"250594591575556118992363477885586059022",
"236118458327971990833704921425605449285",
"60898456291115530969563006027471581376",
"141361052584661155793877436255283841262",
"21102874963313364425952669606991495137",
"171958618104158434961741324265801593183",
"91707608552749299602694532399748668343",
"173181745393294593844423028850518900886",
"33090303761939815461658570703313545360",
"173880521449037069779885989482883441940",
"251225104820449925102918327637528316335",
"242233283779809593337628517108706199919",
"236267346341428878917434510896722954490",
"275239638765666631943667954404628141082"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"function": "ksmbd_session_lookup",
"file": "fs/ksmbd/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-b540f71c",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 179.0,
"function_hash": "307943634417739052779001988056417751553"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"function": "ksmbd_sessions_deregister",
"file": "fs/ksmbd/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-bc947b5a",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 772.0,
"function_hash": "285334952914436883506604738373657733255"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"file": "fs/ksmbd/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-c8043e58",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234587098725212943176763636331141359898",
"68383661627462405998191372053053193609",
"323478462478020166777867526287523874916",
"288225700492177278517742297972536158448",
"292157172241465583806401664140614998807",
"171958618104158434961741324265801593183",
"37930091718922167086027892884249858790",
"135675749795588602641140529107201776344",
"250594591575556118992363477885586059022",
"236118458327971990833704921425605449285",
"60898456291115530969563006027471581376",
"141361052584661155793877436255283841262",
"21102874963313364425952669606991495137",
"171958618104158434961741324265801593183",
"91707608552749299602694532399748668343",
"173181745393294593844423028850518900886",
"33090303761939815461658570703313545360",
"173880521449037069779885989482883441940",
"251225104820449925102918327637528316335",
"242233283779809593337628517108706199919",
"236267346341428878917434510896722954490",
"275239638765666631943667954404628141082"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
"target": {
"file": "fs/smb/server/connection.h"
},
"deprecated": false,
"id": "CVE-2023-52480-d4bab4e6",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100710795064833837170007297861538503093",
"103229390639720184474358168445166648129",
"325866876888009703726374562446207204757",
"205669141726308613811282138419252683958"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"function": "ksmbd_expire_session",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-d71aa23f",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 426.0,
"function_hash": "169289787749274448659710595622096690147"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
"target": {
"function": "ksmbd_conn_alloc",
"file": "fs/ksmbd/connection.c"
},
"deprecated": false,
"id": "CVE-2023-52480-d83337b1",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1083.0,
"function_hash": "326450589118962852321694585523204339311"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"function": "ksmbd_session_lookup",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-f956fa45",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 179.0,
"function_hash": "307943634417739052779001988056417751553"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ced78b0ebccc2d16f426143dc56ab3aad666be",
"target": {
"function": "ksmbd_session_lookup",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-fe516e37",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 179.0,
"function_hash": "307943634417739052779001988056417751553"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
"target": {
"function": "ksmbd_expire_session",
"file": "fs/smb/server/mgmt/user_session.c"
},
"deprecated": false,
"id": "CVE-2023-52480-ff9b492f",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 426.0,
"function_hash": "169289787749274448659710595622096690147"
}
}
]