In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: defer publishing granted locks to prevent UAF\/double-free race<\/p>\n
In smb2_lock(), mid-batch granted locks are published to connection-wide
\n(conn->lock_list) and file-wide (fp->lock_list) lists immediately upon
\nvfs_lock_file() success, while also remaining tracked on the stack-local
\nrollback_list.<\/p>\n
If a subsequent element in the same SMB2_LOCK request array fails
\nvalidation or execution, the thread jumps to out: and walks
\nrollback_list to undo previously granted locks. However, because the
\ngranted lock was already published to conn->lock_list, a concurrent
\nUNLOCK request on the same connection can find the lock object and
\nkfree() it before the rollback loop executes.<\/p>\n
When the granting thread subsequently walks rollback_list, it
\ndereferences and frees the already-freed ksmbd_lock structure, resulting
\nin a Use-After-Free and Double-Free (on both ksmbd_lock and struct
\nfile_lock).<\/p>\n
Fix this by deferring the publication of granted locks to
\nconn->lock_list and fp->lock_list until after the entire array of lock
\nelements has been processed without error. Mid-batch grants remain
\ntracked exclusively on the request-local rollback_list until the whole
\nbatch succeeds, eliminating the race window.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: defer publishing granted locks to prevent UAF\/double-free race<\/p>\n
In smb2_lock(), mid-batch granted locks are published to con<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25571","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25571","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25571"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25571"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25571"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}