Executive brief
The Linux kernel's CIFS (Common Internet File System) implementation handles file sharing and network connectivity for SMB/CIFS servers. A use-after-free vulnerability in the session reconnect logic could allow an attacker to crash the system or potentially execute code by manipulating session state during reconnection attempts.
Technical details
This is a use-after-free vulnerability in the smb2_reconnect_server() function within fs/smb/client/smb2pdu.c. The vulnerable code was collecting exiting sessions during reconnection without checking their state; these sessions could be freed while still being referenced, leading to potential code execution or denial of service. The fix adds a session state check (SES_EXITING) under ses_lock protection to skip exiting sessions that will soon be released via cifs_free_ipc() and logoff(). The vulnerability affects the kernel's SMB/CIFS client implementation and requires a local or network-based trigger during active reconnection scenarios.
Affected products
- Linux Linux kernel Multiple versions prior to fix commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65
Timeline
- 2023-06-26: disclosed
- 2023-08-23: patched