In the Linux kernel, the following vulnerability has been resolved:
cifs: prevent use-after-free by freeing the cfile later
In smb2compoundop we have a possible use-after-free which can cause hard to debug problems later on.
This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27712650866719889857900631289967145119",
"107603683472769845290460991678354546040",
"235661971447048348466816558454946302385",
"249381554410090175652875989008994147446",
"248050625351732050336162569000615742933",
"60971292601072824933150160316421198573",
"37298903560093387690502810678901371798",
"88785216654111858854195026009930460890"
]
},
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fe07d55a5461e66a55fbefb57f85ff0facea32b",
"id": "CVE-2023-53377-0a35f15c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27712650866719889857900631289967145119",
"107603683472769845290460991678354546040",
"235661971447048348466816558454946302385",
"249381554410090175652875989008994147446",
"248050625351732050336162569000615742933",
"60971292601072824933150160316421198573",
"37298903560093387690502810678901371798",
"88785216654111858854195026009930460890"
]
},
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d017880782cf71f8820ee4a2002843893176501d",
"id": "CVE-2023-53377-4ff0dca9",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27712650866719889857900631289967145119",
"107603683472769845290460991678354546040",
"235661971447048348466816558454946302385",
"249381554410090175652875989008994147446",
"248050625351732050336162569000615742933",
"60971292601072824933150160316421198573",
"37298903560093387690502810678901371798",
"88785216654111858854195026009930460890"
]
},
"target": {
"file": "fs/cifs/smb2inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6353518ef8180816e863aa23b06456f395404d6",
"id": "CVE-2023-53377-52614b38",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "36190550593201990775451144738477965039",
"length": 10956.0
},
"target": {
"file": "fs/cifs/smb2inode.c",
"function": "smb2_compound_op"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6353518ef8180816e863aa23b06456f395404d6",
"id": "CVE-2023-53377-7bea1b27",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "330891922178365910012529914073370096785",
"length": 10520.0
},
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4fe07d55a5461e66a55fbefb57f85ff0facea32b",
"id": "CVE-2023-53377-a6f3909c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27712650866719889857900631289967145119",
"107603683472769845290460991678354546040",
"235661971447048348466816558454946302385",
"249381554410090175652875989008994147446",
"248050625351732050336162569000615742933",
"60971292601072824933150160316421198573",
"37298903560093387690502810678901371798",
"88785216654111858854195026009930460890"
]
},
"target": {
"file": "fs/smb/client/smb2inode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33f736187d08f6bc822117629f263b97d3df4165",
"id": "CVE-2023-53377-c892aeb6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "36190550593201990775451144738477965039",
"length": 10956.0
},
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d017880782cf71f8820ee4a2002843893176501d",
"id": "CVE-2023-53377-d5903557",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "36190550593201990775451144738477965039",
"length": 10956.0
},
"target": {
"file": "fs/smb/client/smb2inode.c",
"function": "smb2_compound_op"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33f736187d08f6bc822117629f263b97d3df4165",
"id": "CVE-2023-53377-d91648a0",
"deprecated": false,
"signature_version": "v1"
}
]