In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free of signing key
Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race:
task A task B cifsmount() dfsmountshare() getsession() cifsmountgetsession() cifssendrecv() cifsgetsmbses() compoundsendrecv() cifssetupsession() smb2setuprequest() kfreesensitive() smb2calcsignature() cryptoshash_setkey() UAF
Fix this by ensuring that we have a valid @ses->authkey.response by checking whether @ses->sesstatus is SESGOOD or SESEXITING with @ses->seslock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2reconnectserver()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->authkey.response), so it's safe to access signing key when @ses->sesstatus == SESEXITING.
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 184.0,
"function_hash": "275844082274735437372985643869251375260"
},
"target": {
"file": "fs/smb/client/smb2transport.c",
"function": "smb2_find_smb_ses"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343d7fe6df9e247671440a932b6a73af4fa86d95",
"signature_version": "v1",
"id": "CVE-2024-53179-013ea182"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"36259631386720568640200803263147715153",
"211972597783669629829276822817065490434",
"216891327378016372339775016639207630336",
"241781566769925224534638552029030646461",
"151882038811764846874016674852725791995",
"94900023994424585492071637314988948338",
"50733680287300136875714285270379172905",
"19355870834727044068663901054038134280",
"259101108978633854719633715143256789285",
"327879846375129702364224487323542330877",
"248217630549628073001167510371619009878",
"292816917743600733622990619443868758999",
"53598160340164580824705372011073797578",
"54083650562108689907669347798690691270",
"200992911096901668310157823914791659447",
"92886196950792834126989136651946026759",
"284193470042320177881515568751727658567",
"155986915961879167443102357579260100375",
"211338434069076855360432534514206521744",
"316695479955667668784965395810950848338",
"146191497589878409020664267431477576593",
"183622402594266009050661749804353139218",
"281311307698740343615933635978747410592",
"81038327600866845924798171465221194308",
"142280024447329864790987770669321755702",
"207177639227157589873141894921965578338",
"135265213103393759811503812083978377308",
"311287478744047882556445841726534571340",
"250821545171985806624278811665169075604",
"198453447588420352808766885242467758179",
"41179023115354178011967942179564612638",
"172539110782114046188241464520429212558",
"139194933281588747017723470005051634634",
"88397250996395635451929252276376946544",
"246408635516190150502575939572798197538",
"52327552490699911670584630442347448077",
"222831738516516400906702069861259174992",
"57878964794559990550444230025708762932",
"194233940129895841125737558359756695373"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/smb2transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591",
"signature_version": "v1",
"id": "CVE-2024-53179-0cc45e64"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"36259631386720568640200803263147715153",
"211972597783669629829276822817065490434",
"216891327378016372339775016639207630336",
"241781566769925224534638552029030646461",
"151882038811764846874016674852725791995",
"94900023994424585492071637314988948338",
"50733680287300136875714285270379172905",
"19355870834727044068663901054038134280",
"259101108978633854719633715143256789285",
"327879846375129702364224487323542330877",
"248217630549628073001167510371619009878",
"292816917743600733622990619443868758999",
"53598160340164580824705372011073797578",
"54083650562108689907669347798690691270",
"200992911096901668310157823914791659447",
"92886196950792834126989136651946026759",
"284193470042320177881515568751727658567",
"155986915961879167443102357579260100375",
"211338434069076855360432534514206521744",
"316695479955667668784965395810950848338",
"146191497589878409020664267431477576593",
"183622402594266009050661749804353139218",
"281311307698740343615933635978747410592",
"81038327600866845924798171465221194308",
"142280024447329864790987770669321755702",
"207177639227157589873141894921965578338",
"135265213103393759811503812083978377308",
"311287478744047882556445841726534571340",
"250821545171985806624278811665169075604",
"198453447588420352808766885242467758179",
"41179023115354178011967942179564612638",
"172539110782114046188241464520429212558",
"139194933281588747017723470005051634634",
"88397250996395635451929252276376946544",
"246408635516190150502575939572798197538",
"52327552490699911670584630442347448077",
"222831738516516400906702069861259174992",
"57878964794559990550444230025708762932",
"194233940129895841125737558359756695373"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/smb2transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39619c65ab4bbb3e78c818f537687653e112764d",
"signature_version": "v1",
"id": "CVE-2024-53179-31d7e04b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1529.0,
"function_hash": "118801513917613193722316947492353049000"
},
"target": {
"file": "fs/smb/client/smb2transport.c",
"function": "smb2_calc_signature"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343d7fe6df9e247671440a932b6a73af4fa86d95",
"signature_version": "v1",
"id": "CVE-2024-53179-4b1f517d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 184.0,
"function_hash": "275844082274735437372985643869251375260"
},
"target": {
"file": "fs/smb/client/smb2transport.c",
"function": "smb2_find_smb_ses"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591",
"signature_version": "v1",
"id": "CVE-2024-53179-7a09bdae"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1529.0,
"function_hash": "118801513917613193722316947492353049000"
},
"target": {
"file": "fs/smb/client/smb2transport.c",
"function": "smb2_calc_signature"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591",
"signature_version": "v1",
"id": "CVE-2024-53179-9e154d4e"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"81416197863223499967445145302428589228",
"151048774019572926077345758854569473992",
"162680975378589102541440329707642686716",
"295673470227341509890346896502108147907",
"23293780792074866842460278774050552839"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/smb2proto.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343d7fe6df9e247671440a932b6a73af4fa86d95",
"signature_version": "v1",
"id": "CVE-2024-53179-bcdb1c96"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 184.0,
"function_hash": "275844082274735437372985643869251375260"
},
"target": {
"file": "fs/smb/client/smb2transport.c",
"function": "smb2_find_smb_ses"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39619c65ab4bbb3e78c818f537687653e112764d",
"signature_version": "v1",
"id": "CVE-2024-53179-bd526c7f"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1529.0,
"function_hash": "118801513917613193722316947492353049000"
},
"target": {
"file": "fs/smb/client/smb2transport.c",
"function": "smb2_calc_signature"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39619c65ab4bbb3e78c818f537687653e112764d",
"signature_version": "v1",
"id": "CVE-2024-53179-cca06b84"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"36259631386720568640200803263147715153",
"211972597783669629829276822817065490434",
"216891327378016372339775016639207630336",
"241781566769925224534638552029030646461",
"151882038811764846874016674852725791995",
"94900023994424585492071637314988948338",
"50733680287300136875714285270379172905",
"19355870834727044068663901054038134280",
"259101108978633854719633715143256789285",
"327879846375129702364224487323542330877",
"248217630549628073001167510371619009878",
"292816917743600733622990619443868758999",
"53598160340164580824705372011073797578",
"54083650562108689907669347798690691270",
"200992911096901668310157823914791659447",
"92886196950792834126989136651946026759",
"284193470042320177881515568751727658567",
"155986915961879167443102357579260100375",
"211338434069076855360432534514206521744",
"316695479955667668784965395810950848338",
"146191497589878409020664267431477576593",
"183622402594266009050661749804353139218",
"281311307698740343615933635978747410592",
"81038327600866845924798171465221194308",
"142280024447329864790987770669321755702",
"207177639227157589873141894921965578338",
"135265213103393759811503812083978377308",
"311287478744047882556445841726534571340",
"250821545171985806624278811665169075604",
"198453447588420352808766885242467758179",
"41179023115354178011967942179564612638",
"172539110782114046188241464520429212558",
"139194933281588747017723470005051634634",
"88397250996395635451929252276376946544",
"246408635516190150502575939572798197538",
"52327552490699911670584630442347448077",
"222831738516516400906702069861259174992",
"57878964794559990550444230025708762932",
"194233940129895841125737558359756695373"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/smb2transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343d7fe6df9e247671440a932b6a73af4fa86d95",
"signature_version": "v1",
"id": "CVE-2024-53179-dfa78ba9"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"81416197863223499967445145302428589228",
"151048774019572926077345758854569473992",
"162680975378589102541440329707642686716",
"295673470227341509890346896502108147907",
"23293780792074866842460278774050552839"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/smb2proto.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39619c65ab4bbb3e78c818f537687653e112764d",
"signature_version": "v1",
"id": "CVE-2024-53179-f77501c4"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"81416197863223499967445145302428589228",
"151048774019572926077345758854569473992",
"162680975378589102541440329707642686716",
"295673470227341509890346896502108147907",
"23293780792074866842460278774050552839"
],
"threshold": 0.9
},
"target": {
"file": "fs/smb/client/smb2proto.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591",
"signature_version": "v1",
"id": "CVE-2024-53179-fcadd279"
}
]