In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential deadlock when releasing mids
All releasemid() callers seem to hold a reference of @mid so there is no need to call krefput(&mid->refcount, _releasemid) under @server->mid_lock spinlock. If they don't, then an use-after-free bug would have occurred anyways.
By getting rid of such spinlock also fixes a potential deadlock as shown below
cifsdemultiplexthread() cifsdebugdataprocshow() releasemid() spinlock(&server->midlock); spinlock(&cifstcpseslock) spinlock(&server->midlock) _releasemid() smb2findsmbtcon() spinlock(&cifstcpseslock) deadlock
[
{
"id": "CVE-2023-52757-00e8e350",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99f476e27aad5964ab13777d84fda67d1356dec1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182904386736383286266896877763227486425",
"18912152265903560541419205074439050995",
"196150192873854186207585634311534211906",
"101831010617376753865739459289345203914"
]
},
"target": {
"file": "fs/cifs/smb2misc.c"
}
},
{
"id": "CVE-2023-52757-5ca07385",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99f476e27aad5964ab13777d84fda67d1356dec1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "210804264834439942542602192730278601928",
"length": 2016.0
},
"target": {
"function": "_cifs_mid_q_entry_release",
"file": "fs/cifs/transport.c"
}
},
{
"id": "CVE-2023-52757-69cb58f8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99f476e27aad5964ab13777d84fda67d1356dec1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "306399161724084284370789197437970349566",
"length": 163.0
},
"target": {
"function": "cifs_mid_q_entry_release",
"file": "fs/cifs/transport.c"
}
},
{
"id": "CVE-2023-52757-8942961f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99f476e27aad5964ab13777d84fda67d1356dec1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"39742162287113468711455995104298768791",
"255819318416118497684137359464791631822",
"168987151439830247015753783254748476719",
"26867242028602670100007502129125853485",
"233684105303980211196225794444181786412"
]
},
"target": {
"file": "fs/cifs/cifsproto.h"
}
},
{
"id": "CVE-2023-52757-b3c24598",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99f476e27aad5964ab13777d84fda67d1356dec1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "251573095630623355062751650399171159603",
"length": 453.0
},
"target": {
"function": "__smb2_handle_cancelled_cmd",
"file": "fs/cifs/smb2misc.c"
}
},
{
"id": "CVE-2023-52757-c7098785",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99f476e27aad5964ab13777d84fda67d1356dec1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96218082691854513688425617778603457290",
"337746834284587462538171230836883472866",
"49095650489628270433994503514906227131",
"154196730086695371120419840633498806767",
"219200974936639912905725250073413836127",
"233153101493809329322477145979914288412",
"115279224385604766330379813551355237216",
"92558258467734111074352649883334306570",
"220141846594861113545776607399100527373",
"126456926361996595980809421660454823212",
"280344530740777793985773787614171891974",
"38455549249026192152922346844568264883",
"284313492001860704451294437557798109633"
]
},
"target": {
"file": "fs/cifs/transport.c"
}
}
]