In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free in smb2queryinfo_compound()
The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm'
BUG: KASAN: slab-use-after-free in smb2queryinfocompound+0x423/0x6d0 [cifs] Read of size 8 at addr ffff888014941048 by task xfsio/27534
CPU: 0 PID: 27534 Comm: xfsio Not tainted 6.6.0-rc7 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dumpstacklvl+0x4a/0x80 printreport+0xcf/0x650 ? srsoaliasreturnthunk+0x5/0x7f ? srsoaliasreturnthunk+0x5/0x7f ? physaddr+0x46/0x90 kasanreport+0xda/0x110 ? smb2queryinfocompound+0x423/0x6d0 [cifs] ? smb2queryinfocompound+0x423/0x6d0 [cifs] smb2queryinfocompound+0x423/0x6d0 [cifs] ? _pfxsmb2queryinfocompound+0x10/0x10 [cifs] ? srsoaliasreturnthunk+0x5/0x7f ? _stackdepotsave+0x39/0x480 ? kasansavestack+0x33/0x60 ? kasansettrack+0x25/0x30 ? kasanslabfree+0x126/0x170 smb2queryfs+0xc2/0x2c0 [cifs] ? pfxsmb2queryfs+0x10/0x10 [cifs] ? _pfxlockacquire+0x10/0x10 smb311queryfs+0x210/0x220 [cifs] ? pfxsmb311queryfs+0x10/0x10 [cifs] ? srsoaliasreturnthunk+0x5/0x7f ? _lockacquire+0x480/0x26c0 ? lockrelease+0x1ed/0x640 ? srsoaliasreturnthunk+0x5/0x7f ? dorawspinunlock+0x9b/0x100 cifsstatfs+0x18c/0x4b0 [cifs] statfsbydentry+0x9b/0xf0 fdstatfs+0x4e/0xb0 _dosysfstatfs+0x7f/0xe0 ? _pfxdosysfstatfs+0x10/0x10 ? srsoaliasreturnthunk+0x5/0x7f ? lockdephardirqsonprepare+0x136/0x200 ? srsoaliasreturnthunk+0x5/0x7f dosyscall64+0x3f/0x90 entrySYSCALL64after_hwframe+0x6e/0xd8
Allocated by task 27534: kasansavestack+0x33/0x60 kasansettrack+0x25/0x30 _kasankmalloc+0x8f/0xa0 opencacheddir+0x71b/0x1240 [cifs] smb2queryinfocompound+0x5c3/0x6d0 [cifs] smb2queryfs+0xc2/0x2c0 [cifs] smb311queryfs+0x210/0x220 [cifs] cifsstatfs+0x18c/0x4b0 [cifs] statfsbydentry+0x9b/0xf0 fdstatfs+0x4e/0xb0 _dosysfstatfs+0x7f/0xe0 dosyscall64+0x3f/0x90 entrySYSCALL64afterhwframe+0x6e/0xd8
Freed by task 27534: kasansavestack+0x33/0x60 kasansettrack+0x25/0x30 kasansavefreeinfo+0x2b/0x50 __kasanslabfree+0x126/0x170 slabfreefreelisthook+0xd0/0x1e0 _kmemcachefree+0x9d/0x1b0 opencacheddir+0xff5/0x1240 [cifs] smb2queryinfocompound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs]
This is a race between opencacheddir() and cacheddirleasebreak() where the cache entry for the open directory handle receives a lease break while creating it. And before returning from opencacheddir(), we put the last reference of the new @cfid because of !@cfid->haslease.
Besides the UAF, while running xfstests a lot of missed lease breaks have been noticed in tests that run several concurrent statfs(2) calls on those cached fids
CIFS: VFS: \w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \w22-root1.gandalf.test smb buf 00000000715bfe83 len 108 CIFS: VFS: Dump pending requests: CIFS: VFS: \w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ...
To fix both, in opencacheddir() ensure that @cfid->haslease is set right before sending out compounded request so that any potential lease break will be get processed by demultiplex thread while we're still caching @cfid. And, if open failed for some reason, re-check @cfid->haslease to decide whether or not put lease reference.
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db94d08359c43f2c8fe372811cdee04564a41b9",
        "target": {
            "function": "find_or_create_cached_dir",
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-2a629805",
        "signature_type": "Function",
        "digest": {
            "length": 914.0,
            "function_hash": "310843315471749784802681443191889529519"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93877b9afc2994c89362007aac480a7b150f386f",
        "target": {
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-3548b795",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "255693118219134124387250166563515432677",
                "186452548160689252654738835036540276160",
                "324205715626228384480375249407146865258",
                "165831616309921325781861071840700720676",
                "42993964356901513859101873962223240874",
                "76843532405890762552657781893903908374",
                "278089123563049759840369224893940116034",
                "16685192253138888691232699708049102727",
                "107420350102840110909043792904020170322",
                "99146840091088477860708233649228017702",
                "53823248413165224614675039130019120820",
                "253919511211566262424412634909531109484",
                "157014138097957367243946164021008747550",
                "318657706663878255430568597800602639458",
                "177659101403696754227253217463644762243",
                "226483069172411050137381809118763566814",
                "16677107664265607127361559421586671959",
                "92875900649739403499498215007677288907",
                "202334168497852360150740170330197195586",
                "316861068372495720865562158680000824129",
                "330966774017750434920967381828672545153",
                "131414904148985496910529395757426703702",
                "225822818798643764565466183036679096654",
                "163478188184511193609364795206838291774",
                "57284811881307467661357527168900604310",
                "207746634880784462915808466440625973773",
                "4992652261725303577818045988812451003",
                "123560803430683879312344014426667671166",
                "144131027576928200250806318064861400047",
                "215097506896405583842906379820617622305",
                "82675787973103141817680656272719469630",
                "41623157722056427118735182647295952741",
                "319728804910883163860493622763759276552",
                "109909824319971611488399842217997350414",
                "263107444231181267169182707605907217592",
                "182181097907945325255892947587198310005",
                "301576092695335790943477211863630288039",
                "138114971786372376515165309278531376923",
                "61607288960815066273710810248759883810",
                "98673910426116132903792510476296287825",
                "55806732378604598591186486817176559245",
                "328784414747907893838636540422229624525",
                "19975445677443192588096626142668042390",
                "232804089187755732948174275302451003177",
                "179511173322095983894053449646516027040",
                "201118016027965305430935512486723269271",
                "177564722567345821387970624658190015216",
                "285151084478749689208849310693070886130",
                "2563626561356005098454339148332165277",
                "60240077353155818710556484638321934650",
                "213691796059901770778796026363744542782",
                "230032064603825319719299661404240000869",
                "338618975659220902794379909176707744264",
                "237922225412071919205715613397296542116",
                "118278202899782866507507740302453442613",
                "280187693883123920090927706015812276916",
                "22544985704896062187979009433389986391",
                "150581728479414849815177512534978618470",
                "274715044365414658530615995767418142466",
                "281886388506500155215652178083722964294",
                "290601877316566437408504955233628799224",
                "189118336388642338417695888045207841533",
                "261922278305088767182118975045983630386",
                "330613502086689934036930491097137466162",
                "103807980151849538070575698910190353451",
                "4411590510166328651165575220405045900",
                "293633936110073236669418112169233095441",
                "66106403362474124105291094957805790967",
                "219491621083194912692568504847339136463",
                "125867143283951840803328140343847339207",
                "8574222676755354489752515773490156348",
                "181718242550214836820988927894939281056",
                "106334268539847615704617267036916285663",
                "124759762685939732507153768451558975708",
                "234017864779181575363353328327277447229",
                "185821760131356557221446013245704747628",
                "115727162140681735120211896843422262566",
                "219416954331301939923567992758056461201",
                "7099113094439375115695864536824752518",
                "12529237121136253185456629876618163276",
                "65767367273241081248035387794166622061"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c86919455c1edec99ebd3338ad213b59271a71b",
        "target": {
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-5817a795",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "255693118219134124387250166563515432677",
                "186452548160689252654738835036540276160",
                "324205715626228384480375249407146865258",
                "165831616309921325781861071840700720676",
                "42993964356901513859101873962223240874",
                "76843532405890762552657781893903908374",
                "278089123563049759840369224893940116034",
                "16685192253138888691232699708049102727",
                "107420350102840110909043792904020170322",
                "99146840091088477860708233649228017702",
                "53823248413165224614675039130019120820",
                "253919511211566262424412634909531109484",
                "157014138097957367243946164021008747550",
                "318657706663878255430568597800602639458",
                "177659101403696754227253217463644762243",
                "226483069172411050137381809118763566814",
                "16677107664265607127361559421586671959",
                "92875900649739403499498215007677288907",
                "202334168497852360150740170330197195586",
                "316861068372495720865562158680000824129",
                "330966774017750434920967381828672545153",
                "131414904148985496910529395757426703702",
                "225822818798643764565466183036679096654",
                "163478188184511193609364795206838291774",
                "57284811881307467661357527168900604310",
                "207746634880784462915808466440625973773",
                "4992652261725303577818045988812451003",
                "123560803430683879312344014426667671166",
                "144131027576928200250806318064861400047",
                "215097506896405583842906379820617622305",
                "82675787973103141817680656272719469630",
                "41623157722056427118735182647295952741",
                "319728804910883163860493622763759276552",
                "109909824319971611488399842217997350414",
                "263107444231181267169182707605907217592",
                "182181097907945325255892947587198310005",
                "301576092695335790943477211863630288039",
                "138114971786372376515165309278531376923",
                "61607288960815066273710810248759883810",
                "98673910426116132903792510476296287825",
                "55806732378604598591186486817176559245",
                "328784414747907893838636540422229624525",
                "19975445677443192588096626142668042390",
                "232804089187755732948174275302451003177",
                "179511173322095983894053449646516027040",
                "201118016027965305430935512486723269271",
                "177564722567345821387970624658190015216",
                "285151084478749689208849310693070886130",
                "2563626561356005098454339148332165277",
                "60240077353155818710556484638321934650",
                "213691796059901770778796026363744542782",
                "230032064603825319719299661404240000869",
                "338618975659220902794379909176707744264",
                "237922225412071919205715613397296542116",
                "118278202899782866507507740302453442613",
                "280187693883123920090927706015812276916",
                "22544985704896062187979009433389986391",
                "150581728479414849815177512534978618470",
                "274715044365414658530615995767418142466",
                "281886388506500155215652178083722964294",
                "290601877316566437408504955233628799224",
                "189118336388642338417695888045207841533",
                "261922278305088767182118975045983630386",
                "330613502086689934036930491097137466162",
                "103807980151849538070575698910190353451",
                "4411590510166328651165575220405045900",
                "293633936110073236669418112169233095441",
                "66106403362474124105291094957805790967",
                "219491621083194912692568504847339136463",
                "125867143283951840803328140343847339207",
                "8574222676755354489752515773490156348",
                "181718242550214836820988927894939281056",
                "106334268539847615704617267036916285663",
                "124759762685939732507153768451558975708",
                "234017864779181575363353328327277447229",
                "185821760131356557221446013245704747628",
                "115727162140681735120211896843422262566",
                "219416954331301939923567992758056461201",
                "7099113094439375115695864536824752518",
                "12529237121136253185456629876618163276",
                "65767367273241081248035387794166622061"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c86919455c1edec99ebd3338ad213b59271a71b",
        "target": {
            "function": "open_cached_dir",
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-674f95a7",
        "signature_type": "Function",
        "digest": {
            "length": 4505.0,
            "function_hash": "324636455759495121541130477376229252314"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c86919455c1edec99ebd3338ad213b59271a71b",
        "target": {
            "function": "find_or_create_cached_dir",
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-74228dfd",
        "signature_type": "Function",
        "digest": {
            "length": 914.0,
            "function_hash": "310843315471749784802681443191889529519"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db94d08359c43f2c8fe372811cdee04564a41b9",
        "target": {
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-bcbdc455",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "255693118219134124387250166563515432677",
                "186452548160689252654738835036540276160",
                "324205715626228384480375249407146865258",
                "165831616309921325781861071840700720676",
                "42993964356901513859101873962223240874",
                "76843532405890762552657781893903908374",
                "278089123563049759840369224893940116034",
                "16685192253138888691232699708049102727",
                "107420350102840110909043792904020170322",
                "99146840091088477860708233649228017702",
                "53823248413165224614675039130019120820",
                "253919511211566262424412634909531109484",
                "157014138097957367243946164021008747550",
                "318657706663878255430568597800602639458",
                "177659101403696754227253217463644762243",
                "226483069172411050137381809118763566814",
                "16677107664265607127361559421586671959",
                "92875900649739403499498215007677288907",
                "202334168497852360150740170330197195586",
                "316861068372495720865562158680000824129",
                "330966774017750434920967381828672545153",
                "131414904148985496910529395757426703702",
                "225822818798643764565466183036679096654",
                "163478188184511193609364795206838291774",
                "57284811881307467661357527168900604310",
                "207746634880784462915808466440625973773",
                "4992652261725303577818045988812451003",
                "123560803430683879312344014426667671166",
                "144131027576928200250806318064861400047",
                "215097506896405583842906379820617622305",
                "82675787973103141817680656272719469630",
                "41623157722056427118735182647295952741",
                "319728804910883163860493622763759276552",
                "109909824319971611488399842217997350414",
                "263107444231181267169182707605907217592",
                "182181097907945325255892947587198310005",
                "301576092695335790943477211863630288039",
                "138114971786372376515165309278531376923",
                "61607288960815066273710810248759883810",
                "98673910426116132903792510476296287825",
                "55806732378604598591186486817176559245",
                "328784414747907893838636540422229624525",
                "19975445677443192588096626142668042390",
                "232804089187755732948174275302451003177",
                "179511173322095983894053449646516027040",
                "201118016027965305430935512486723269271",
                "177564722567345821387970624658190015216",
                "285151084478749689208849310693070886130",
                "2563626561356005098454339148332165277",
                "60240077353155818710556484638321934650",
                "213691796059901770778796026363744542782",
                "230032064603825319719299661404240000869",
                "338618975659220902794379909176707744264",
                "237922225412071919205715613397296542116",
                "118278202899782866507507740302453442613",
                "280187693883123920090927706015812276916",
                "22544985704896062187979009433389986391",
                "150581728479414849815177512534978618470",
                "274715044365414658530615995767418142466",
                "281886388506500155215652178083722964294",
                "290601877316566437408504955233628799224",
                "189118336388642338417695888045207841533",
                "261922278305088767182118975045983630386",
                "330613502086689934036930491097137466162",
                "103807980151849538070575698910190353451",
                "4411590510166328651165575220405045900",
                "293633936110073236669418112169233095441",
                "66106403362474124105291094957805790967",
                "219491621083194912692568504847339136463",
                "125867143283951840803328140343847339207",
                "8574222676755354489752515773490156348",
                "181718242550214836820988927894939281056",
                "106334268539847615704617267036916285663",
                "124759762685939732507153768451558975708",
                "234017864779181575363353328327277447229",
                "185821760131356557221446013245704747628",
                "115727162140681735120211896843422262566",
                "219416954331301939923567992758056461201",
                "7099113094439375115695864536824752518",
                "12529237121136253185456629876618163276",
                "65767367273241081248035387794166622061"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93877b9afc2994c89362007aac480a7b150f386f",
        "target": {
            "function": "open_cached_dir",
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-bd11fa81",
        "signature_type": "Function",
        "digest": {
            "length": 4505.0,
            "function_hash": "324636455759495121541130477376229252314"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93877b9afc2994c89362007aac480a7b150f386f",
        "target": {
            "function": "find_or_create_cached_dir",
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-db066656",
        "signature_type": "Function",
        "digest": {
            "length": 914.0,
            "function_hash": "310843315471749784802681443191889529519"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db94d08359c43f2c8fe372811cdee04564a41b9",
        "target": {
            "function": "open_cached_dir",
            "file": "fs/smb/client/cached_dir.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2023-52751-ef54481c",
        "signature_type": "Function",
        "digest": {
            "length": 4505.0,
            "function_hash": "324636455759495121541130477376229252314"
        }
    }
]