In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free in smb2_query_info_compound()
The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm'
BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs] Read of size 8 at addr ffff888014941048 by task xfs_io/27534
CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x80 print_report+0xcf/0x650 ? srso_alias_return_thunk+0x5/0x7f ? srso_alias_return_thunk+0x5/0x7f ? __phys_addr+0x46/0x90 kasan_report+0xda/0x110 ? smb2_query_info_compound+0x423/0x6d0 [cifs] ? smb2_query_info_compound+0x423/0x6d0 [cifs] smb2_query_info_compound+0x423/0x6d0 [cifs] ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __stack_depot_save+0x39/0x480 ? kasan_save_stack+0x33/0x60 ? kasan_set_track+0x25/0x30 ? ____kasan_slab_free+0x126/0x170 smb2_queryfs+0xc2/0x2c0 [cifs] ? __pfx_smb2_queryfs+0x10/0x10 [cifs] ? __pfx___lock_acquire+0x10/0x10 smb311_queryfs+0x210/0x220 [cifs] ? __pfx_smb311_queryfs+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f ? __lock_acquire+0x480/0x26c0 ? lock_release+0x1ed/0x640 ? srso_alias_return_thunk+0x5/0x7f ? do_raw_spin_unlock+0x9b/0x100 cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 ? __pfx___do_sys_fstatfs+0x10/0x10 ? srso_alias_return_thunk+0x5/0x7f ? lockdep_hardirqs_on_prepare+0x136/0x200 ? srso_alias_return_thunk+0x5/0x7f do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Allocated by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 open_cached_dir+0x71b/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] smb311_queryfs+0x210/0x220 [cifs] cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 ____kasan_slab_free+0x126/0x170 slab_free_freelist_hook+0xd0/0x1e0 __kmem_cache_free+0x9d/0x1b0 open_cached_dir+0xff5/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs]
This is a race between open_cached_dir() and cached_dir_lease_break() where the cache entry for the open directory handle receives a lease break while creating it. And before returning from open_cached_dir(), we put the last reference of the new @cfid because of !@cfid->has_lease.
Besides the UAF, while running xfstests a lot of missed lease breaks have been noticed in tests that run several concurrent statfs(2) calls on those cached fids
CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108 CIFS: VFS: Dump pending requests: CIFS: VFS: \\w22-root1.gandalf.test No task to wake, unknown frame... CIFS: VFS: \\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFS: VFS: \\w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ...
To fix both, in open_cached_dir() ensure that @cfid->has_lease is set right before sending out compounded request so that any potential lease break will be get processed by demultiplex thread while we're still caching @cfid. And, if open failed for some reason, re-check @cfid->has_lease to decide whether or not put lease reference.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-livepatch-6.1.115-126.197Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade bpftool-debuginfo | Feb 17, 2025 | May 21, 2024 |
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 5, 2024 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade dtb-alteraUpgrade dtb-mediatekUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-develUpgrade dtb-caviumUpgrade kernel-azureUpgrade kernel-64kb-optionalUpgrade kernel-sourceUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade kernel-source-azureUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade kernel-devel-rtUpgrade dtb-sprdUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-rtUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade dtb-amazonUpgrade kernel-rt-vdsoUpgrade kernel-default-develUpgrade reiserfs-kmp-64kbUpgrade dtb-rockchipUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-rtUpgrade dtb-freescaleUpgrade kernel-source-rtUpgrade dlm-kmp-azureUpgrade kernel-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-azure-vdsoUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade dtb-apmUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-syms-rtUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-marvellUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade kernel-docsUpgrade kernel-rtUpgrade kernel-obs-buildUpgrade kernel-macrosUpgrade dtb-appleUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-rt-extraUpgrade kselftests-kmp-rtUpgrade kernel-default-extraUpgrade kselftests-kmp-azureUpgrade reiserfs-kmp-rtUpgrade dtb-amlogicUpgrade kernel-azure-livepatch-develUpgrade dtb-socionextUpgrade kernel-syms-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-zfcpdumpUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-defaultUpgrade dtb-broadcom | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-azureUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-azure-cvmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1078-azure | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub