In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check<\/p>\n
Two concurrent SMB2 durable reconnects (DH2C\/DHnC) on the same
\npersistent_id race the fp->owner.name compare-read in
\nksmbd_vfs_compare_durable_owner() against the kfree() in
\nksmbd_reopen_durable_fd()’s reopen-success path. fp->owner.name is a
\nstandalone kstrdup() buffer whose lifetime is independent of the fp
\nrefcount, and the two sites share no lock: the compare reads the buffer
\nwhile the reopen frees it, so the strcmp() can dereference freed memory.<\/p>\n
Commit 7ce4fc40018d (“ksmbd: fix durable reconnect double-bind race in
\nksmbd_reopen_durable_fd”) made the fp->conn claim atomic under
\nglobal_ft.lock (closing the owner.name double-free and the ksmbd_file
\nwrite-UAF), but the compare-read versus reopen-free pair was left
\nunserialized.<\/p>\n
BUG: KASAN: slab-use-after-free in strcmp+0x2c\/0x80
\n Read of size 1 by task kworker
\n strcmp
\n ksmbd_vfs_compare_durable_owner
\n smb2_check_durable_oplock
\n smb2_open
\n Freed by task kworker:
\n kfree
\n ksmbd_reopen_durable_fd
\n smb2_open
\n Allocated by task kworker:
\n kstrdup
\n session_fd_check
\n smb2_session_logoff
\n The buggy address belongs to the cache kmalloc-8<\/p>\n
Serialize both sides of the race with fp->f_lock. The global durable
\nfile-table lock still protects the durable reconnect claim, but
\nfp->owner.name is per-open state and does not need to block unrelated
\ndurable table lookups or reconnects. The teardown is left at its
\nexisting location after the reopen-success point so that an __open_id()
\nrollback still retains owner.name for a later legitimate reconnect to
\nverify.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check<\/p>\n
Two concurrent SMB2 durable reconnects (DH2C\/DHnC) on th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7025","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7025","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7025"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7025"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7025"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}