CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free bug in cifsdebugdataprocshow()
Skip SMB sessions that are being teared down (e.g. @ses->sesstatus == SESEXITING) in cifsdebugdataprocshow() to avoid use-after-free in @ses.
This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting
[ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? dieaddr+0x36/0x90 [ 816.260762] ? excgeneralprotection+0x1b3/0x410 [ 816.261126] ? asmexcgeneralprotection+0x26/0x30 [ 816.261502] ? cifsdebugtcon+0xbd/0x240 [cifs] [ 816.261878] ? cifsdebugtcon+0xab/0x240 [cifs] [ 816.262249] cifsdebugdataprocshow+0x516/0xdb0 [cifs] [ 816.262689] ? seqreaditer+0x379/0x470 [ 816.262995] seqreaditer+0x118/0x470 [ 816.263291] procregreaditer+0x53/0x90 [ 816.263596] ? srsoaliasreturnthunk+0x5/0x7f [ 816.263945] vfsread+0x201/0x350 [ 816.264211] ksysread+0x75/0x100 [ 816.264472] dosyscall64+0x3f/0x90 [ 816.264750] entrySYSCALL64afterhwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Update the SMB client code so that cifs_debug_data_proc_show() skips SMB sessions that are being teared down (e.g., when @ses->ses_status == SES_EXITING) to avoid a use-after-free/GPP when reading /proc/fs/cifs/DebugData during mounting and umounting.
Linux kernel SMB client (cifs) /proc/fs/cifs/DebugData Skip SMB sessions being torn down (ses_status == SES_EXITING) in cifs_debug_data_proc_show() = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52752?
CVE-2023-52752 has been rated as a high severity vulnerability due to the potential for use-after-free conditions in the Linux kernel.
How do I fix CVE-2023-52752?
To fix CVE-2023-52752, update your Linux kernel to versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions of the Linux kernel are affected by CVE-2023-52752?
CVE-2023-52752 affects Linux kernel versions earlier than 6.1.64 and those in the ranges 6.2 to 6.5.13 and 6.6 to 6.6.3.
What components are involved in CVE-2023-52752?
CVE-2023-52752 involves the CIFS (Common Internet File System) client within the Linux kernel.
Is there a workaround for CVE-2023-52752?
There is no official workaround for CVE-2023-52752, therefore updating to a fixed version is recommended.