In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix use-after-free in rdata->readintopages()
When the network status is unstable, use-after-free may occur when read data from the server.
BUG: KASAN: use-after-free in readpagesfillpages+0x14c/0x7e0
Call Trace: <TASK> dumpstacklvl+0x38/0x4c printreport+0x16f/0x4a6 kasanreport+0xb7/0x130 readpagesfillpages+0x14c/0x7e0 cifsreadvreceive+0x46d/0xa40 cifsdemultiplexthread+0x121c/0x1490 kthread+0x16b/0x1a0 retfromfork+0x2c/0x50 </TASK>
Allocated by task 2535: kasansavestack+0x22/0x50 kasansettrack+0x25/0x30 _kasankmalloc+0x82/0x90 cifsreaddatadirectalloc+0x2c/0x110 cifsreaddataalloc+0x2d/0x60 cifsreadahead+0x393/0xfe0 readpages+0x12f/0x470 pagecacheraunbounded+0x1b1/0x240 filemapgetpages+0x1c8/0x9a0 filemapread+0x1c0/0x540 cifsstrictreadv+0x21b/0x240 vfsread+0x395/0x4b0 ksysread+0xb8/0x150 dosyscall64+0x3f/0x90 entrySYSCALL64after_hwframe+0x72/0xdc
Freed by task 79: kasansavestack+0x22/0x50 kasansettrack+0x25/0x30 kasansavefreeinfo+0x2e/0x50 _kasanslabfree+0x10e/0x1a0 _kmemcachefree+0x7a/0x1a0 cifsreaddatarelease+0x49/0x60 processonework+0x46c/0x760 workerthread+0x2a4/0x6f0 kthread+0x16b/0x1a0 retfromfork+0x2c/0x50
Last potentially related work creation: kasansavestack+0x22/0x50 _kasanrecordauxstack+0x95/0xb0 insertwork+0x2b/0x130 _queuework+0x1fe/0x660 queueworkon+0x4b/0x60 smb2readvcallback+0x396/0x800 cifsabortconnection+0x474/0x6a0 cifsreconnect+0x5cb/0xa50 cifsreadvfromsocket.cold+0x22/0x6c cifsreadpagefromsocket+0xc1/0x100 readpagesfillpages.cold+0x2f/0x46 cifsreadvreceive+0x46d/0xa40 cifsdemultiplexthread+0x121c/0x1490 kthread+0x16b/0x1a0 retfrom_fork+0x2c/0x50
The following function calls will cause UAF of the rdata pointer.
readpagesfillpages cifsreadpagefromsocket cifsreadvfromsocket cifsreconnect _cifsreconnect cifsabortconnection mid->callback() --> smb2readvcallback queuework(&rdata->work) # if the worker completes first, # the rdata is freed cifsreadvcomplete krefput cifsreaddatarelease kfree(rdata) return rdata->... # UAF in readpagesfillpages()
Similarly, this problem also occurs in the uncachefillpages().
Fix this by adjusts the order of condition judgment in the return statement.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5465aeca3c66fecdf7efcf554aed79b4c4b211",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "readpages_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-3859e3f7",
"digest": {
"length": 1426.0,
"function_hash": "190087092455496634777881364853644627600"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5465aeca3c66fecdf7efcf554aed79b4c4b211",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-3ed3298b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289",
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5465aeca3c66fecdf7efcf554aed79b4c4b211",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "uncached_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-52efa068",
"digest": {
"length": 949.0,
"function_hash": "322401891680218155032766520012099281225"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1fba1e096ffc7ec11df863a97c50203c47315b9",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "uncached_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-659e18da",
"digest": {
"length": 949.0,
"function_hash": "322401891680218155032766520012099281225"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b693fe3f760c87fd9768e759f6297f743a1b3b0",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-93ecc099",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289",
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b693fe3f760c87fd9768e759f6297f743a1b3b0",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "readpages_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-9cc1e615",
"digest": {
"length": 1464.0,
"function_hash": "236325673925522697515518237058059509276"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3684a2f6affa1ca52a5d4a12f04d0652efdee65e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-9f905830",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289",
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1fba1e096ffc7ec11df863a97c50203c47315b9",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-a42f3224",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289",
"133200419398648727586486232165593748104",
"86842106367550073808825865451133627507",
"274371234995951859887701740848327341496",
"205788710613389756203752362864108085289"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3684a2f6affa1ca52a5d4a12f04d0652efdee65e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "readpages_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-b8f0fb53",
"digest": {
"length": 1426.0,
"function_hash": "190087092455496634777881364853644627600"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b693fe3f760c87fd9768e759f6297f743a1b3b0",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "uncached_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-be6085ea",
"digest": {
"length": 949.0,
"function_hash": "322401891680218155032766520012099281225"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1fba1e096ffc7ec11df863a97c50203c47315b9",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "readpages_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-c5376796",
"digest": {
"length": 1464.0,
"function_hash": "236325673925522697515518237058059509276"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3684a2f6affa1ca52a5d4a12f04d0652efdee65e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "uncached_fill_pages",
"file": "fs/cifs/file.c"
},
"id": "CVE-2023-52741-f6651af2",
"digest": {
"length": 949.0,
"function_hash": "322401891680218155032766520012099281225"
},
"signature_type": "Function"
}
]