In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in smb2reconnectserver()
The UAF bug is due to smb2reconnectserver() accessing a session that is already being teared down by another thread that is executing _cifsputsmbses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->sesstatus again to something different than SESEXITING.
To fix this, we need to make sure to unconditionally set @ses->sesstatus to SESEXITING and prevent any other threads from setting a new status while we're still tearing it down.
The following can be reproduced by adding some delay to right after the ipc is freed in _cifsputsmbses() - which will give smb2reconnectserver() worker a chance to run and then accessing @ses->ipc:
kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echointerval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2reconnectserver [cifs] RIP: 0010:listdelentryvalidorreport+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? dieaddr+0x36/0x90 ? excgeneralprotection+0x1c1/0x3f0 ? asmexcgeneralprotection+0x26/0x30 ? _listdelentryvalidorreport+0x33/0xf0 _cifsputsmbses+0x1ae/0x500 [cifs] smb2reconnectserver+0x4ed/0x710 [cifs] processonework+0x205/0x6b0 workerthread+0x191/0x360 ? _pfxworkerthread+0x10/0x10 kthread+0xe2/0x110 ? _pfxkthread+0x10/0x10 retfromfork+0x34/0x50 ? _pfxkthread+0x10/0x10 retfromfork_asm+0x1a/0x30 </TASK>
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"91968238297685670571540074214466388051",
"277116902418708371536180479350299132006",
"113477960854159565425342240721497025063",
"212750884366353722771948850797607994795",
"288434007282812354609867462088692290548",
"130782686396437693106128342504260559876",
"231428931683141955398004066117791350263",
"74776768209163810296046921415849913327",
"338856721687517191843979775922193927268",
"114130157170762723630173064795478554687",
"122076069146689655724950728819361285443",
"17336126296011380977843622878282514546",
"101743635638789521656511559934554910538",
"278825324607573845601117120383636850966",
"106389457132119387356374621735502468529",
"278253446337292474729628977989075084358",
"162030836625922334352491337988356716611",
"93524296763325160698076442613532995177",
"292030665901809209035923718308638891307",
"219864868595331530491990378147237616426",
"317937983526872431349235684580032529340",
"233209962698479040967290697685585531624",
"65330911973338457711701876160658744920",
"168803393952140101833782798524385714260",
"230564474187819692852902034807341036016",
"273812123799325601025558988059905136245",
"20203945726770718122726618916891771826",
"283390536529156446081143504222321887568",
"321799206484889721617261394653255205628",
"236487516484735432679130146836209785695",
"215024648106139686865635951690243266915",
"181487906465712538038741323974004361693",
"225609732263776225430469946052547686029",
"155713804012309593721318980419233649530",
"181567596679062440441994845946235298072",
"193670668784042847799973171687337690934",
"103377844516606078737017059898168726896",
"151426089042412380850664770687718378449",
"87216857562429017791563365342982275622",
"152039261194444765632649355175804020957",
"166270312775271163096229635719528973498",
"312600274077244799902980822541639824751",
"153369247156915537421146840623833923733",
"39956679424291206437375149038321152928",
"102074540804282637804574693173587044693",
"137697149647966534078267574201581687910",
"179272385806638466723635167227648071183",
"223742817218923821887591510142314224796",
"95198995084114347657391021466648053426",
"29268892838310687905297360379113600101",
"73987102860386344608271781052547372599",
"236249950980033131824818886205936813022",
"33499199497576837186137865559396009401",
"221694518460442565282160832473717025819",
"251376489516648075459285020585279630748",
"320587496816981177353366868934079926621"
]
},
"target": {
"file": "fs/smb/client/connect.c"
},
"signature_version": "v1",
"id": "CVE-2024-35870-073e218e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "221864857019206561323376313447970765433",
"length": 1652.0
},
"target": {
"file": "fs/smb/client/connect.c",
"function": "cifs_mark_tcp_ses_conns_for_reconnect"
},
"signature_version": "v1",
"id": "CVE-2024-35870-1a9a7339",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "238461785610601975145182607263154152615",
"length": 1793.0
},
"target": {
"file": "fs/smb/client/connect.c",
"function": "__cifs_put_smb_ses"
},
"signature_version": "v1",
"id": "CVE-2024-35870-3133b37b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "202118076403617456228457149266969191955",
"length": 164.0
},
"target": {
"file": "fs/smb/client/connect.c",
"function": "cifs_free_ipc"
},
"signature_version": "v1",
"id": "CVE-2024-35870-fe42ef5d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa"
}
]