In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free in smb2_query_info_compound()
The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm'
BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs] Read of size 8 at addr ffff888014941048 by task xfs_io/27534
CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0x7f ? srso_alias_return_thunk+0x5/0x7f ? __phys_addr+0x46/0x90 kasan_report+0xda/0x110 ? smb2_query_info_compound+0x423/0x6d0 [cifs] ? smb2_query_info_compound+0x423/0x6d0 [cifs] smb2_query_info_compound+0x423/0x6d0 [cifs] ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __stack_depot_save+0x39/0x480 ? kasan_save_stack+0x33/0x60 ? kasan_set_track+0x25/0x30 ? ____kasan_slab_free+0x126/0x170 smb2_queryfs+0xc2/0x2c0 [cifs] ? __pfx_smb2_queryfs+0x10/0x10 [cifs] ? __pfx___lock_acquire+0x10/0x10 smb311_queryfs+0x210/0x220 [cifs] ? __pfx_smb311_queryfs+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __lock_acquire+0x480/0x26c0 ? lock_release+0x1ed/0x640 ? srso_alias_return_thunk+0x5/0x7f ? do_raw_spin_unlock+0x9b/0x100 cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 ? __pfx___do_sys_fstatfs+0x10/0x10 ? srso_alias_return_thunk+0x5/0x7f ? lockdep_hardirqs_on_prepare+0x136/0x200 ? srso_alias_return_thunk+0x5/0x7f do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Allocated by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 open_cached_dir+0x71b/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] smb311_queryfs+0x210/0x220 [cifs] cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 ____kasan_slab_free+0x126/0x170 slab_free_freelist_hook+0xd0/0x1e0 __kmem_cache_free+0x9d/0x1b0 open_cached_dir+0xff5/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs]
This is a race between open_cached_dir() and cached_dir_lease_break() where the cache entry for the open directory handle receives a lease break while creating it. And before returning from open_cached_dir(), we put the last reference of the new @cfid because of !@cfid->has_lease.
Besides the UAF, while running xfstests a lot of missed lease breaks have been noticed in tests that run several concurrent statfs(2) calls on those cached fids
CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108 CIFS: VFS: Dump pending requests: CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ...
To fix both, in open_cached_dir() ensure that @cfid->has_lease is set right before sending out compounded request so that any potential lease break will be get processed by demultiplex thread while we're still caching @cfid. And, if open failed for some reason, re-check @cfid->has_lease to decide whether or not put lease reference.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade perfUpgrade kernelUpgrade kernel-modules-extra-commonUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.115-126.197Upgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade bpftool | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | May 21, 2024 |
| Suse | — | Upgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kernel-debug-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-rt-extraUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade kernel-rtUpgrade dtb-marvellUpgrade kernel-azure-extraUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade dtb-apmUpgrade kernel-docsUpgrade kselftests-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-rtUpgrade kernel-docs-htmlUpgrade dtb-amlogicUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-azure-livepatch-develUpgrade dtb-appleUpgrade kernel-obs-qaUpgrade kernel-default-extraUpgrade kernel-64kb-livepatch-develUpgrade dtb-amazonUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-macrosUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade kernel-rt_debug-vdsoUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade kernel-64kbUpgrade dtb-rockchipUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-default-base-rebuildUpgrade dtb-armUpgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade kernel-rt-develUpgrade kernel-debugUpgrade kernel-symsUpgrade kernel-azureUpgrade kernel-develUpgrade dtb-caviumUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-debug-develUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-default-vdsoUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade reiserfs-kmp-azureUpgrade kernel-azure-optionalUpgrade dtb-amdUpgrade dtb-mediatekUpgrade kernel-debug-vdsoUpgrade kernel-devel-rtUpgrade kernel-source-azureUpgrade kernel-defaultUpgrade dtb-nvidiaUpgrade dtb-exynosUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-default-baseUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-64kb | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1075-azureUpgrade linux-image-azureUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-azure-lts-22.04 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub