In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()<\/p>\n
When the else branch of cifs_file_set_size() finds a writable file handle
\nvia find_writable_file(), it borrows tcon and server from the handle’s
\ntlink, attempts the handle-based set_file_size() RPC, and then releases
\nthe handle with cifsFileInfo_put().<\/p>\n
If set_file_size() fails, execution falls through to the path-based
\nfallback, which reuses the borrowed tcon and server under the
\n“if (tcon == NULL)” guard. Since tcon is not NULL at that point, the
\nguard is skipped. If cifsFileInfo_put() dropped the last reference on a
\ntlink that was already removed from the tlink tree (TCON_LINK_IN_TREE
\ncleared, as happens during reconnection or session teardown),
\ncifs_put_tlink() will have freed tcon; the subsequent set_path_size()
\ncall is then a use-after-free.<\/p>\n
Setting tcon = NULL after cifsFileInfo_put() causes the existing guard
\nto take the cifs_sb_tlink() path, which acquires a fresh reference for
\nthe path-based operation or fails cleanly if the session is gone.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()<\/p>\n
When the else branch of cifs_file_set_size() finds a writable fi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21563","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}