Executive brief
The Linux kernel's CIFS (SMB3 file sharing protocol) implementation did not properly protect access to a deferred file close list, allowing multiple processes to modify it simultaneously. In systems that rely on SMB3 for network file sharing, this could lead to memory corruption, file handle leaks, or service crashes that disrupt access to shared files and resources.
Technical details
The vulnerability is a race condition in the CIFS filesystem driver (fs/cifs/misc.c) where the `cifs_del_deferred_close()` function modifies a shared deferred close file list without holding the required spin lock (`deferred_lock`). The vulnerable code path occurs in three functions: `cifs_close_deferred_file()`, `cifs_close_all_deferred_files()`, and `cifs_close_deferred_file_under_dentry()`. An attacker with local access to a system mounting CIFS shares could trigger concurrent file operations that race to access and corrupt the deferred close list, causing memory corruption or kernel crashes. The fix adds spin lock acquisition/release around each `cifs_del_deferred_close()` call to serialize access. The vulnerability is triggered through normal file operations on CIFS mounts and requires no authentication bypass.
Affected products
- Linux Linux kernel 5.0 through 6.8 and certain stable branches
Timeline
- 2023-04-20: disclosed: Patch authored by Bharath SM
- 2023-05-11: patched: Merged into stable kernel trees