In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix use-after-free in __close_file_table_ids()<\/p>\n
A ksmbd_file can remain alive after logical close while another session
\nholds a temporary reference obtained through ksmbd_lookup_fd_inode().
\nksmbd_close_fd() currently marks the file closed and drops the idr-owned
\nreference, but leaves the pointer published in the closing session’s idr
\nuntil the final reference is dropped.<\/p>\n
If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()
\nsupplies the foreign session’s file table to __ksmbd_close_fd(). The object
\nis then freed without being removed from its owner’s idr, and the owner
\nsession later dereferences the stale pointer during file-table teardown.<\/p>\n
Remove the volatile id from the owner’s idr while ksmbd_close_fd() still
\nholds that table’s lock, and clear volatile_id before dropping
\nthe idr-owned reference. A later foreign final put then only performs
\nphysical destruction and cannot remove the object from the wrong table.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: fix use-after-free in __close_file_table_ids()<\/p>\n
A ksmbd_file can remain alive after logical close while another session
\nhold<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7526","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}