In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free bug in cifsdebugdataprocshow()
Skip SMB sessions that are being teared down (e.g. @ses->sesstatus == SESEXITING) in cifsdebugdataprocshow() to avoid use-after-free in @ses.
This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting
[ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? dieaddr+0x36/0x90 [ 816.260762] ? excgeneralprotection+0x1b3/0x410 [ 816.261126] ? asmexcgeneralprotection+0x26/0x30 [ 816.261502] ? cifsdebugtcon+0xbd/0x240 [cifs] [ 816.261878] ? cifsdebugtcon+0xab/0x240 [cifs] [ 816.262249] cifsdebugdataprocshow+0x516/0xdb0 [cifs] [ 816.262689] ? seqreaditer+0x379/0x470 [ 816.262995] seqreaditer+0x118/0x470 [ 816.263291] procregreaditer+0x53/0x90 [ 816.263596] ? srsoaliasreturnthunk+0x5/0x7f [ 816.263945] vfsread+0x201/0x350 [ 816.264211] ksysread+0x75/0x100 [ 816.264472] dosyscall64+0x3f/0x90 [ 816.264750] entrySYSCALL64afterhwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ab6f842452ce2cae04209d4671ac6289d0aef8a",
"target": {
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"line_hashes": [
"35347072742058895756230494302071642585",
"263327304009742139902312478700809342116",
"129404384556459471605739129531036677040",
"8838207311954252429649570365443093354",
"252125763080047004061305711195901584773",
"142344549046314181607761587396967339809",
"77211651476538762719564560014834765700",
"6301639495164496891468028069860950665"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-52752-1d86fca4",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@558817597d5fbd7af31f891b67b0fd20f0d047b7",
"target": {
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"line_hashes": [
"53972710898032572679337957712741862606",
"263327304009742139902312478700809342116",
"129404384556459471605739129531036677040",
"8838207311954252429649570365443093354",
"252125763080047004061305711195901584773",
"142344549046314181607761587396967339809",
"77211651476538762719564560014834765700",
"6301639495164496891468028069860950665"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-52752-23d9f9bf",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2abdf136784b7edaec7ffe0f4b461b63f9c4c4de",
"target": {
"file": "fs/cifs/cifs_debug.c"
},
"digest": {
"line_hashes": [
"244849251584006079636040137772548112952",
"210902032890704956641288636678197114522",
"219996850220722262580846060738081899723",
"58556935237828920034555203041376061503"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-52752-4073da3e",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89929ea46f9cc11ba66d2c64713aa5d5dc723b09",
"target": {
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"line_hashes": [
"35347072742058895756230494302071642585",
"263327304009742139902312478700809342116",
"129404384556459471605739129531036677040",
"8838207311954252429649570365443093354",
"252125763080047004061305711195901584773",
"142344549046314181607761587396967339809",
"77211651476538762719564560014834765700",
"6301639495164496891468028069860950665"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-52752-4c71d888",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336a066990bb3962c46daf574ace596bda9303ce",
"target": {
"function": "cifs_debug_data_proc_show",
"file": "fs/cifs/cifs_debug.c"
},
"digest": {
"function_hash": "202954591124268119122284011204582862988",
"length": 8631.0
},
"deprecated": false,
"id": "CVE-2023-52752-561c7d1a",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ab6f842452ce2cae04209d4671ac6289d0aef8a",
"target": {
"function": "cifs_debug_data_proc_show",
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"function_hash": "210303963056191307579126112648277983938",
"length": 9856.0
},
"deprecated": false,
"id": "CVE-2023-52752-89912f35",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d328c09ee9f15ee5a26431f5aad7c9239fa85e62",
"target": {
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"line_hashes": [
"35347072742058895756230494302071642585",
"263327304009742139902312478700809342116",
"129404384556459471605739129531036677040",
"8838207311954252429649570365443093354",
"252125763080047004061305711195901584773",
"142344549046314181607761587396967339809",
"77211651476538762719564560014834765700",
"6301639495164496891468028069860950665"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-52752-91f2edfb",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@558817597d5fbd7af31f891b67b0fd20f0d047b7",
"target": {
"function": "cifs_debug_data_proc_show",
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"function_hash": "112708612296628677306301849273103929446",
"length": 9202.0
},
"deprecated": false,
"id": "CVE-2023-52752-9a507e9a",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336a066990bb3962c46daf574ace596bda9303ce",
"target": {
"file": "fs/cifs/cifs_debug.c"
},
"digest": {
"line_hashes": [
"210315645956058489537189864409049630065",
"329688646865044767471510838078085800398",
"26339000252812685917116457174104028617",
"164572430041344561763192725251062881364"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2023-52752-9c469e2d",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89929ea46f9cc11ba66d2c64713aa5d5dc723b09",
"target": {
"function": "cifs_debug_data_proc_show",
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"function_hash": "210303963056191307579126112648277983938",
"length": 9856.0
},
"deprecated": false,
"id": "CVE-2023-52752-b1c3262a",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2abdf136784b7edaec7ffe0f4b461b63f9c4c4de",
"target": {
"function": "cifs_debug_data_proc_show",
"file": "fs/cifs/cifs_debug.c"
},
"digest": {
"function_hash": "213224000231094902345930913768534506063",
"length": 8122.0
},
"deprecated": false,
"id": "CVE-2023-52752-ce62d1ba",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d328c09ee9f15ee5a26431f5aad7c9239fa85e62",
"target": {
"function": "cifs_debug_data_proc_show",
"file": "fs/smb/client/cifs_debug.c"
},
"digest": {
"function_hash": "210303963056191307579126112648277983938",
"length": 9856.0
},
"deprecated": false,
"id": "CVE-2023-52752-ef01ce9e",
"signature_type": "Function",
"signature_version": "v1"
}
]