smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.142, 6.12.92, 6.18.34, 6.20, 7.0.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 953953abb66e52c224057ab91e404284fefeab62 · fixed in 7df1df6f40c0720d30206aa35c0343b962350e0d; From 601dd3b79769b38d30b693c40afdb2a4b7edf9d0 · fixed in 13fb413ae22a37c69341918a6d651d19a9b0b9b7; From 3969db6b22e3d90d8c5f22ac1a7fe0350a94c136 · fixed in bf4ebdb19ff9b3cdf992b50715fe61633327416a; From 96c4af418586ee9a6aab61738644366426e05316 · fixed in e374f4e496fef8168784f93a4477d67be34485fd; From 96c4af418586ee9a6aab61738644366426e05316 · fixed in 4d8690dace005a38e6dbde9ecce2da3ad85c7c41; From 6.6.128 · fixed in 6.6.142; From 6.12.75 · fixed in 6.12.92; From 6.18.16 · fixed in 6.18.34; From 6.19.6 · fixed in 6.20
- Linux Linux
7.0
- KernelLinux
fixed in 6.6.142; From 6.7.0 · fixed in 6.12.92; From 6.13.0 · fixed in 6.18.34; From 6.19.0 · fixed in 7.0.11