Executive brief
The Linux kernel's CIFS (Common Internet File System) implementation contains a use-after-free vulnerability in its distributed file system (DFS) handling code. An attacker could exploit this race condition when the kernel attempts to connect to an IPC share, potentially causing a denial of service or arbitrary code execution. Systems using CIFS to mount remote file shares are at risk.
Technical details
The vulnerability is a use-after-free race condition in the CIFS DFS code (fs/cifs/dfs.c), specifically in the __tree_connect_dfs_target() function. The root cause is unprotected access to TCP_Server_Info::hostname, which can be freed by the cifsd thread while another thread is building the IPC tree name. The attack vector is local/network-based and requires an active CIFS connection to a server performing DFS operations. An attacker with network access to a vulnerable CIFS client could trigger the race condition by manipulating DFS referral responses during tree connection. The fix adds proper locking (cifs_server_lock) around hostname access and refactors IPC tree connection logic into dedicated functions that safely handle concurrent access.
Affected products
- Linux Linux kernel v6.2 and later
Timeline
- 2023-04-25: disclosed
- 2023-05-11: patched