In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in smb2reconnectserver()
The UAF bug is due to smb2reconnectserver() accessing a session that is already being teared down by another thread that is executing _cifsputsmbses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->sesstatus again to something different than SESEXITING.
To fix this, we need to make sure to unconditionally set @ses->sesstatus to SESEXITING and prevent any other threads from setting a new status while we're still tearing it down.
The following can be reproduced by adding some delay to right after the ipc is freed in _cifsputsmbses() - which will give smb2reconnectserver() worker a chance to run and then accessing @ses->ipc:
kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echointerval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2reconnectserver [cifs] RIP: 0010:listdelentryvalidorreport+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? dieaddr+0x36/0x90 ? excgeneralprotection+0x1c1/0x3f0 ? asmexcgeneralprotection+0x26/0x30 ? _listdelentryvalidorreport+0x33/0xf0 _cifsputsmbses+0x1ae/0x500 [cifs] smb2reconnectserver+0x4ed/0x710 [cifs] processonework+0x205/0x6b0 workerthread+0x191/0x360 ? _pfxworkerthread+0x10/0x10 kthread+0xe2/0x110 ? _pfxkthread+0x10/0x10 retfromfork+0x34/0x50 ? _pfxkthread+0x10/0x10 retfromfork_asm+0x1a/0x30 </TASK>
{ "vanir_signatures": [ { "id": "CVE-2024-35870-073e218e", "signature_type": "Line", "target": { "file": "fs/smb/client/connect.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "91968238297685670571540074214466388051", "277116902418708371536180479350299132006", "113477960854159565425342240721497025063", "212750884366353722771948850797607994795", "288434007282812354609867462088692290548", "130782686396437693106128342504260559876", "231428931683141955398004066117791350263", "74776768209163810296046921415849913327", "338856721687517191843979775922193927268", "114130157170762723630173064795478554687", "122076069146689655724950728819361285443", "17336126296011380977843622878282514546", "101743635638789521656511559934554910538", "278825324607573845601117120383636850966", "106389457132119387356374621735502468529", "278253446337292474729628977989075084358", "162030836625922334352491337988356716611", "93524296763325160698076442613532995177", "292030665901809209035923718308638891307", "219864868595331530491990378147237616426", "317937983526872431349235684580032529340", "233209962698479040967290697685585531624", "65330911973338457711701876160658744920", "168803393952140101833782798524385714260", "230564474187819692852902034807341036016", "273812123799325601025558988059905136245", "20203945726770718122726618916891771826", "283390536529156446081143504222321887568", "321799206484889721617261394653255205628", "236487516484735432679130146836209785695", "215024648106139686865635951690243266915", "181487906465712538038741323974004361693", "225609732263776225430469946052547686029", "155713804012309593721318980419233649530", "181567596679062440441994845946235298072", "193670668784042847799973171687337690934", "103377844516606078737017059898168726896", "151426089042412380850664770687718378449", "87216857562429017791563365342982275622", "152039261194444765632649355175804020957", "166270312775271163096229635719528973498", "312600274077244799902980822541639824751", "153369247156915537421146840623833923733", "39956679424291206437375149038321152928", "102074540804282637804574693173587044693", "137697149647966534078267574201581687910", "179272385806638466723635167227648071183", "223742817218923821887591510142314224796", "95198995084114347657391021466648053426", "29268892838310687905297360379113600101", "73987102860386344608271781052547372599", "236249950980033131824818886205936813022", "33499199497576837186137865559396009401", "221694518460442565282160832473717025819", "251376489516648075459285020585279630748", "320587496816981177353366868934079926621" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa" }, { "id": "CVE-2024-35870-1a9a7339", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "cifs_mark_tcp_ses_conns_for_reconnect" }, "signature_version": "v1", "digest": { "length": 1652.0, "function_hash": "221864857019206561323376313447970765433" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa" }, { "id": "CVE-2024-35870-3133b37b", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "__cifs_put_smb_ses" }, "signature_version": "v1", "digest": { "length": 1793.0, "function_hash": "238461785610601975145182607263154152615" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa" }, { "id": "CVE-2024-35870-4bd5e135", "signature_type": "Line", "target": { "file": "fs/smb/client/connect.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "91968238297685670571540074214466388051", "277116902418708371536180479350299132006", "113477960854159565425342240721497025063", "212750884366353722771948850797607994795", "288434007282812354609867462088692290548", "130782686396437693106128342504260559876", "231428931683141955398004066117791350263", "74776768209163810296046921415849913327", "338856721687517191843979775922193927268", "114130157170762723630173064795478554687", "122076069146689655724950728819361285443", "17336126296011380977843622878282514546", "101743635638789521656511559934554910538", "278825324607573845601117120383636850966", "106389457132119387356374621735502468529", "278253446337292474729628977989075084358", "162030836625922334352491337988356716611", "93524296763325160698076442613532995177", "292030665901809209035923718308638891307", "219864868595331530491990378147237616426", "317937983526872431349235684580032529340", "233209962698479040967290697685585531624", "65330911973338457711701876160658744920", "168803393952140101833782798524385714260", "230564474187819692852902034807341036016", "273812123799325601025558988059905136245", "20203945726770718122726618916891771826", "283390536529156446081143504222321887568", "321799206484889721617261394653255205628", "236487516484735432679130146836209785695", "215024648106139686865635951690243266915", "181487906465712538038741323974004361693", "225609732263776225430469946052547686029", "155713804012309593721318980419233649530", "181567596679062440441994845946235298072", "193670668784042847799973171687337690934", "103377844516606078737017059898168726896", "151426089042412380850664770687718378449", "87216857562429017791563365342982275622", "152039261194444765632649355175804020957", "166270312775271163096229635719528973498", "312600274077244799902980822541639824751", "153369247156915537421146840623833923733", "39956679424291206437375149038321152928", "102074540804282637804574693173587044693", "137697149647966534078267574201581687910", "179272385806638466723635167227648071183", "223742817218923821887591510142314224796", "95198995084114347657391021466648053426", "29268892838310687905297360379113600101", "73987102860386344608271781052547372599", "236249950980033131824818886205936813022", "33499199497576837186137865559396009401", "221694518460442565282160832473717025819", "251376489516648075459285020585279630748", "320587496816981177353366868934079926621" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f2beda1f1bc3d962ec07db1ccc3197c25499a5" }, { "id": "CVE-2024-35870-8b0841ab", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "cifs_mark_tcp_ses_conns_for_reconnect" }, "signature_version": "v1", "digest": { "length": 1652.0, "function_hash": "221864857019206561323376313447970765433" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0" }, { "id": "CVE-2024-35870-8d188237", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "cifs_mark_tcp_ses_conns_for_reconnect" }, "signature_version": "v1", "digest": { "length": 1652.0, "function_hash": "221864857019206561323376313447970765433" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f2beda1f1bc3d962ec07db1ccc3197c25499a5" }, { "id": "CVE-2024-35870-8fa40c6a", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "cifs_free_ipc" }, "signature_version": "v1", "digest": { "length": 164.0, "function_hash": "202118076403617456228457149266969191955" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f2beda1f1bc3d962ec07db1ccc3197c25499a5" }, { "id": "CVE-2024-35870-abb58604", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "__cifs_put_smb_ses" }, "signature_version": "v1", "digest": { "length": 1793.0, "function_hash": "238461785610601975145182607263154152615" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0" }, { "id": "CVE-2024-35870-c5e162e8", "signature_type": "Line", "target": { "file": "fs/smb/client/connect.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "91968238297685670571540074214466388051", "277116902418708371536180479350299132006", "113477960854159565425342240721497025063", "212750884366353722771948850797607994795", "288434007282812354609867462088692290548", "130782686396437693106128342504260559876", "231428931683141955398004066117791350263", "74776768209163810296046921415849913327", "338856721687517191843979775922193927268", "114130157170762723630173064795478554687", "122076069146689655724950728819361285443", "17336126296011380977843622878282514546", "101743635638789521656511559934554910538", "278825324607573845601117120383636850966", "106389457132119387356374621735502468529", "278253446337292474729628977989075084358", "162030836625922334352491337988356716611", "93524296763325160698076442613532995177", "292030665901809209035923718308638891307", "219864868595331530491990378147237616426", "317937983526872431349235684580032529340", "233209962698479040967290697685585531624", "65330911973338457711701876160658744920", "168803393952140101833782798524385714260", "230564474187819692852902034807341036016", "273812123799325601025558988059905136245", "20203945726770718122726618916891771826", "283390536529156446081143504222321887568", "321799206484889721617261394653255205628", "236487516484735432679130146836209785695", "215024648106139686865635951690243266915", "181487906465712538038741323974004361693", "225609732263776225430469946052547686029", "155713804012309593721318980419233649530", "181567596679062440441994845946235298072", "193670668784042847799973171687337690934", "103377844516606078737017059898168726896", "151426089042412380850664770687718378449", "87216857562429017791563365342982275622", "152039261194444765632649355175804020957", "166270312775271163096229635719528973498", "312600274077244799902980822541639824751", "153369247156915537421146840623833923733", "39956679424291206437375149038321152928", "102074540804282637804574693173587044693", "137697149647966534078267574201581687910", "179272385806638466723635167227648071183", "223742817218923821887591510142314224796", "95198995084114347657391021466648053426", "29268892838310687905297360379113600101", "73987102860386344608271781052547372599", "236249950980033131824818886205936813022", "33499199497576837186137865559396009401", "221694518460442565282160832473717025819", "251376489516648075459285020585279630748", "320587496816981177353366868934079926621" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0" }, { "id": "CVE-2024-35870-ccb0d129", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "cifs_free_ipc" }, "signature_version": "v1", "digest": { "length": 164.0, "function_hash": "202118076403617456228457149266969191955" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0" }, { "id": "CVE-2024-35870-d87cb0b1", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "__cifs_put_smb_ses" }, "signature_version": "v1", "digest": { "length": 1793.0, "function_hash": "238461785610601975145182607263154152615" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45f2beda1f1bc3d962ec07db1ccc3197c25499a5" }, { "id": "CVE-2024-35870-fe42ef5d", "signature_type": "Function", "target": { "file": "fs/smb/client/connect.c", "function": "cifs_free_ipc" }, "signature_version": "v1", "digest": { "length": 164.0, "function_hash": "202118076403617456228457149266969191955" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24a9799aa8efecd0eb55a75e35f9d8e6400063aa" } ] }