In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()<\/p>\n
When a secondary channel is no longer supported by the server,
\ncifs_chan_skip_or_disable() drops the channel reference with
\ncifs_put_tcp_session() and then continues to use the server pointer by
\ncalling cifs_signal_cifsd_for_reconnect() on it and reading its
\nprimary_server pointer. cifs_put_tcp_session() can drop the last
\nreference of the channel and tear it down, so both the channel and the
\nprimary server (whose reference is also dropped by
\ncifs_put_tcp_session()) can be freed before they are signaled for
\nreconnect.<\/p>\n
Signal the channel and the primary server and capture the primary
\nserver pointer before dropping the channel reference with
\ncifs_put_tcp_session().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()<\/p>\n
When a secondary channel is no longer supported by the server,
\ncifs<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33330","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}