In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in SMB request handling
A race condition exists between SMB request handling in
ksmbd_conn_handler_loop() and the freeing of ksmbd_conn in the
workqueue handler handle_ksmbd_work(). This leads to a UAF.
- KASAN: slab-use-after-free Read in handleksmbdwork
- KASAN: slab-use-after-free in rtlockslowlocklocked
This race condition arises as follows:
- ksmbd_conn_handler_loop() waits for conn->r_count to reach zero:
wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);
- Meanwhile, handle_ksmbd_work() decrements conn->r_count using
atomic_dec_return(&conn->r_count), and if it reaches zero, calls
ksmbd_conn_free(), which frees conn.
- However, after handle_ksmbd_work() decrements conn->r_count,
it may still access conn->r_count_q in the following line:
waitqueue_active(&conn->r_count_q) or wake_up(&conn->r_count_q)
This results in a UAF, as conn has already been freed.
The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53186.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53186.json"
[
{
"id": "CVE-2024-53186-08cd8a7f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a96f9eb7add30ba0fafcfe7b7aca090978196800",
"signature_type": "Function",
"target": {
"function": "handle_ksmbd_work",
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 412.0,
"function_hash": "298708368240624770448031687694639592906"
}
},
{
"id": "CVE-2024-53186-23804471",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96261adb998a3b513468b6ce17dbec76be5507d4",
"signature_type": "Line",
"target": {
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335538715856172417791846914379750922231",
"68381623522442126418896343589632430882",
"63826016693359778625918844315475489375",
"280490555465001021783247696746712687931",
"82421440320258376703125379477594650016"
]
}
},
{
"id": "CVE-2024-53186-750e4068",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e",
"signature_type": "Function",
"target": {
"function": "handle_ksmbd_work",
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 412.0,
"function_hash": "298708368240624770448031687694639592906"
}
},
{
"id": "CVE-2024-53186-91db372a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f20b77f7897e6aab9ce5527e6016ad2be5d70a33",
"signature_type": "Line",
"target": {
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335538715856172417791846914379750922231",
"68381623522442126418896343589632430882",
"63826016693359778625918844315475489375",
"280490555465001021783247696746712687931",
"82421440320258376703125379477594650016"
]
}
},
{
"id": "CVE-2024-53186-a3ec84fc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96261adb998a3b513468b6ce17dbec76be5507d4",
"signature_type": "Function",
"target": {
"function": "handle_ksmbd_work",
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 412.0,
"function_hash": "298708368240624770448031687694639592906"
}
},
{
"id": "CVE-2024-53186-bafe6087",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e",
"signature_type": "Line",
"target": {
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335538715856172417791846914379750922231",
"68381623522442126418896343589632430882",
"63826016693359778625918844315475489375",
"280490555465001021783247696746712687931",
"82421440320258376703125379477594650016"
]
}
},
{
"id": "CVE-2024-53186-d025d0a7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f20b77f7897e6aab9ce5527e6016ad2be5d70a33",
"signature_type": "Function",
"target": {
"function": "handle_ksmbd_work",
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 412.0,
"function_hash": "298708368240624770448031687694639592906"
}
},
{
"id": "CVE-2024-53186-f387cc82",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a96f9eb7add30ba0fafcfe7b7aca090978196800",
"signature_type": "Line",
"target": {
"file": "fs/smb/server/server.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"335538715856172417791846914379750922231",
"68381623522442126418896343589632430882",
"63826016693359778625918844315475489375",
"280490555465001021783247696746712687931",
"82421440320258376703125379477594650016"
]
}
}
]