In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE<\/p>\n
conn->preauth_info is shared connection state (struct
\npreauth_integrity_info, kmalloc-96) that is allocated and freed by the
\nSMB2 NEGOTIATE handler and read by the response send path.<\/p>\n
smb2_handle_negotiate() allocates conn->preauth_info, and on a
\ndeassemble_neg_contexts() failure kfrees it and sets it to NULL. Both the
\nallocation and the free\/NULL happen under ksmbd_conn_lock(conn) (the
\nconnection srv_mutex), which is held across the whole handler body.<\/p>\n
The response send path smb3_preauth_hash_rsp(), called from the send:
\nblock of __handle_ksmbd_work(), reads conn->preauth_info and dereferences
\nconn->preauth_info->Preauth_HashValue (via
\nksmbd_gen_preauth_integrity_hash()) without taking conn_lock. When a
\nclient drives two SMB2 NEGOTIATE requests on the same connection, one
\nworker can free conn->preauth_info on the failing-negotiate path while a
\nconcurrent send-path worker is reading it, producing a slab
\nuse-after-free read (KASAN-confirmed).<\/p>\n
The send-path read tested conn->preauth_info for NULL but raced with the
\nfree that occurs between the NULL check and the dereference, so the NULL
\nguard alone does not close the window.<\/p>\n
Serialize the NEGOTIATE-branch read in smb3_preauth_hash_rsp() under
\nksmbd_conn_lock(conn) and re-check conn->preauth_info inside the lock.
\nBecause the negotiate handler holds conn_lock across its kfree + NULL
\nassignment, a reader that also takes conn_lock either runs fully before
\nthe allocation or fully after the NULL store, and can never observe the
\nfreed-but-not-yet-NULLed pointer. ksmbd_gen_preauth_integrity_hash()
\ntakes no locks itself (it only computes a SHA-512 over the buffer), so
\nno lock-ordering inversion is introduced, and conn_lock is a sleepable
\nmutex which is safe on this send path (it already performs network I\/O).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE<\/p>\n
conn->preauth_info is shared connection state (struct<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7079","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}