ksmbd: defer publishing granted locks to prevent UAF/double-free race
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.114, 6.18.57, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list. If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes. When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock). Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 · fixed in b68d4bb6b03a667c305626bd2c242fd162bac17e; From e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 · fixed in 65f54ed0289e9a57e6c60b14347ccea4c318f1fc; From e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 · fixed in ff6870cf3b7eccc69d03cbb6f23e3995d96e9a8d; From e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 · fixed in a1d26dfb32919088e3638dca01068df3c4507433; From e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 · fixed in 29f74f0f2e6df3b393b7b66e810136d0c64e3c59
- Linux Linux
5.15
- KernelLinux
From 5.15.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.6