Paper/Archive/CVE-2023-52480

CVE-2023-52480

Linux Linux — ksmbd: fix race condition between session lookup and expire

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 42.1.421 × 208.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race condition between ksmbd_session_lookup and ksmbd_expire_session.

Affected

ProductAffectedFixed inSource

Linuxa6a9601ba995d0fec635324cb9fd8d14f9bea14e – < c77fd3e25a51ac92b0f1b347a96eff6a0b4f066fc77fd3e25a51ac92b0f1b347a96eff6a0b4f066fCNA

Linux1fc8a2b14ef5223f8e0b95faba2ee0a6e4d0f99d – < a2ca5fd3dbcc665e1169044fa0c9e3eba779202ba2ca5fd3dbcc665e1169044fa0c9e3eba779202bCNA

Linuxea174a91893956450510945a0c5d1a10b5323656 – < 18ced78b0ebccc2d16f426143dc56ab3aad666be18ced78b0ebccc2d16f426143dc56ab3aad666beCNA

Linuxea174a91893956450510945a0c5d1a10b5323656 – < 53ff5cf89142b978b1a5ca8dc4d4425e6a09745f53ff5cf89142b978b1a5ca8dc4d4425e6a09745fCNA

Linux750a2d772e9d9ff377fd32e3b6797bf2cd847a7a–CNA

Linux6775ee7ef4b37c521aa4cf3730f54554c4875542–CNA

Linux6.1.29 – < 6.1.576.1.57CNA

Linux6.2.16 – < 6.36.3CNA

Linux6.3.2 – < 6.46.4CNA

Linux6.46.1.57CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f refgit.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b refgit.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be refgit.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f