CVE-2023-52741: cifs: Fix use-after-free in rdata->read_into_pages()
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix use-after-free in rdata->readintopages()
When the network status is unstable, use-after-free may occur when read data from the server.
BUG: KASAN: use-after-free in readpagesfillpages+0x14c/0x7e0
Call Trace: <TASK> dumpstacklvl+0x38/0x4c printreport+0x16f/0x4a6 kasanreport+0xb7/0x130 readpagesfillpages+0x14c/0x7e0 cifsreadvreceive+0x46d/0xa40 cifsdemultiplexthread+0x121c/0x1490 kthread+0x16b/0x1a0 retfromfork+0x2c/0x50 </TASK>
Allocated by task 2535: kasansavestack+0x22/0x50 kasansettrack+0x25/0x30 kasankmalloc+0x82/0x90 cifsreaddatadirectalloc+0x2c/0x110 cifsreaddataalloc+0x2d/0x60 cifsreadahead+0x393/0xfe0 readpages+0x12f/0x470 pagecacheraunbounded+0x1b1/0x240 filemapgetpages+0x1c8/0x9a0 filemapread+0x1c0/0x540 cifsstrictreadv+0x21b/0x240 vfsread+0x395/0x4b0 ksysread+0xb8/0x150 dosyscall64+0x3f/0x90 entrySYSCALL64afterhwframe+0x72/0xdc
Freed by task 79: kasansavestack+0x22/0x50 kasansettrack+0x25/0x30 kasansavefreeinfo+0x2e/0x50 kasanslabfree+0x10e/0x1a0 kmemcachefree+0x7a/0x1a0 cifsreaddatarelease+0x49/0x60 processonework+0x46c/0x760 workerthread+0x2a4/0x6f0 kthread+0x16b/0x1a0 retfromfork+0x2c/0x50
Last potentially related work creation: kasansavestack+0x22/0x50 kasanrecordauxstack+0x95/0xb0 insertwork+0x2b/0x130 queuework+0x1fe/0x660 queueworkon+0x4b/0x60 smb2readvcallback+0x396/0x800 cifsabortconnection+0x474/0x6a0 cifsreconnect+0x5cb/0xa50 cifsreadvfromsocket.cold+0x22/0x6c cifsreadpagefromsocket+0xc1/0x100 readpagesfillpages.cold+0x2f/0x46 cifsreadvreceive+0x46d/0xa40 cifsdemultiplexthread+0x121c/0x1490 kthread+0x16b/0x1a0 retfromfork+0x2c/0x50
The following function calls will cause UAF of the rdata pointer.
readpagesfillpages cifsreadpagefromsocket cifsreadvfromsocket cifsreconnect cifsreconnect cifsabortconnection mid->callback() --> smb2readvcallback queuework(&rdata->work) # if the worker completes first, # the rdata is freed cifsreadvcomplete krefput cifsreaddatarelease kfree(rdata) return rdata->... # UAF in readpagesfillpages()
Similarly, this problem also occurs in the uncachefillpages().
Fix this by adjusts the order of condition judgment in the return statement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
linux kernel CIFSto a version that resolves this vulnerability.Patch cifs: Fix use-after-free in rdata->read_into_pages()
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52741?
CVE-2023-52741 has been classified with a high severity due to its potential for exploitation through use-after-free errors.
How can I fix CVE-2023-52741?
To fix CVE-2023-52741, users should upgrade their Linux kernel to a patched version beyond 5.10.168 or 5.15.94.
Which versions of the Linux kernel are affected by CVE-2023-52741?
CVE-2023-52741 affects Linux kernel versions before 5.10.168, between 5.11 and 5.15.94, and between 5.16 and 6.1.12, as well as specific release candidates of version 6.2.
What types of systems are impacted by CVE-2023-52741?
CVE-2023-52741 impacts any system running the affected versions of the Linux kernel, particularly those with unstable network conditions.
Is there a known exploit for CVE-2023-52741?
As of now, there are no publically disclosed exploits for CVE-2023-52741, but the vulnerability's nature suggests potential for exploitation.