{"id":"CVE-2023-52741","state":"PUBLISHED","title":"cifs: Fix use-after-free in rdata->read_into_pages()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata->read_into_pages()\n\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\n\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\n\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x38/0x4c\n   print_report+0x16f/0x4a6\n   kasan_report+0xb7/0x130\n   readpages_fill_pages+0x14c/0x7e0\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n   </TASK>\n\n  Allocated by task 2535:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x82/0x90\n   cifs_readdata_direct_alloc+0x2c/0x110\n   cifs_readdata_alloc+0x2d/0x60\n   cifs_readahead+0x393/0xfe0\n   read_pages+0x12f/0x470\n   page_cache_ra_unbounded+0x1b1/0x240\n   filemap_get_pages+0x1c8/0x9a0\n   filemap_read+0x1c0/0x540\n   cifs_strict_readv+0x21b/0x240\n   vfs_read+0x395/0x4b0\n   ksys_read+0xb8/0x150\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n  Freed by task 79:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2e/0x50\n   __kasan_slab_free+0x10e/0x1a0\n   __kmem_cache_free+0x7a/0x1a0\n   cifs_readdata_release+0x49/0x60\n   process_one_work+0x46c/0x760\n   worker_thread+0x2a4/0x6f0\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\n  Last potentially related work creation:\n   kasan_save_stack+0x22/0x50\n   __kasan_record_aux_stack+0x95/0xb0\n   insert_work+0x2b/0x130\n   __queue_work+0x1fe/0x660\n   queue_work_on+0x4b/0x60\n   smb2_readv_callback+0x396/0x800\n   cifs_abort_connection+0x474/0x6a0\n   cifs_reconnect+0x5cb/0xa50\n   cifs_readv_from_socket.cold+0x22/0x6c\n   cifs_read_page_from_socket+0xc1/0x100\n   readpages_fill_pages.cold+0x2f/0x46\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\nThe following function calls will cause UAF of the rdata pointer.\n\nreadpages_fill_pages\n cifs_read_page_from_socket\n  cifs_readv_from_socket\n   cifs_reconnect\n    __cifs_reconnect\n     cifs_abort_connection\n      mid->callback() --> smb2_readv_callback\n       queue_work(&rdata->work)  # if the worker completes first,\n                                 # the rdata is freed\n          cifs_readv_complete\n            kref_put\n              cifs_readdata_release\n                kfree(rdata)\n return rdata->...               # UAF in readpages_fill_pages()\n\nSimilarly, this problem also occurs in the uncache_fill_pages().\n\nFix this by adjusts the order of condition judgment in the return\nstatement.","publishedAt":"2024-05-21T15:23:03.867Z","updatedAt":"2026-08-05T09:11:10.506Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"2b693fe3f760c87fd9768e759f6297f743a1b3b0","versionType":"git"},{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"d1fba1e096ffc7ec11df863a97c50203c47315b9","versionType":"git"},{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"3684a2f6affa1ca52a5d4a12f04d0652efdee65e","versionType":"git"},{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"aa5465aeca3c66fecdf7efcf554aed79b4c4b211","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/file.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.17","versionType":"semver"},{"version":"5.10.168","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.94","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.12","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/file.c"]}],"references":["https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0","https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9","https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e","https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/52xxx/CVE-2023-52741.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52741","state":"PUBLISHED","datePublished":"2024-05-21T15:23:03.867Z","dateUpdated":"2026-08-05T09:11:10.506Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-05-21T15:19:24.233Z"},"containers":{"cna":{"title":"cifs: Fix use-after-free in rdata->read_into_pages()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata->read_into_pages()\n\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\n\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\n\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x38/0x4c\n   print_report+0x16f/0x4a6\n   kasan_report+0xb7/0x130\n   readpages_fill_pages+0x14c/0x7e0\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n   </TASK>\n\n  Allocated by task 2535:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x82/0x90\n   cifs_readdata_direct_alloc+0x2c/0x110\n   cifs_readdata_alloc+0x2d/0x60\n   cifs_readahead+0x393/0xfe0\n   read_pages+0x12f/0x470\n   page_cache_ra_unbounded+0x1b1/0x240\n   filemap_get_pages+0x1c8/0x9a0\n   filemap_read+0x1c0/0x540\n   cifs_strict_readv+0x21b/0x240\n   vfs_read+0x395/0x4b0\n   ksys_read+0xb8/0x150\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n  Freed by task 79:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2e/0x50\n   __kasan_slab_free+0x10e/0x1a0\n   __kmem_cache_free+0x7a/0x1a0\n   cifs_readdata_release+0x49/0x60\n   process_one_work+0x46c/0x760\n   worker_thread+0x2a4/0x6f0\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\n  Last potentially related work creation:\n   kasan_save_stack+0x22/0x50\n   __kasan_record_aux_stack+0x95/0xb0\n   insert_work+0x2b/0x130\n   __queue_work+0x1fe/0x660\n   queue_work_on+0x4b/0x60\n   smb2_readv_callback+0x396/0x800\n   cifs_abort_connection+0x474/0x6a0\n   cifs_reconnect+0x5cb/0xa50\n   cifs_readv_from_socket.cold+0x22/0x6c\n   cifs_read_page_from_socket+0xc1/0x100\n   readpages_fill_pages.cold+0x2f/0x46\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\nThe following function calls will cause UAF of the rdata pointer.\n\nreadpages_fill_pages\n cifs_read_page_from_socket\n  cifs_readv_from_socket\n   cifs_reconnect\n    __cifs_reconnect\n     cifs_abort_connection\n      mid->callback() --> smb2_readv_callback\n       queue_work(&rdata->work)  # if the worker completes first,\n                                 # the rdata is freed\n          cifs_readv_complete\n            kref_put\n              cifs_readdata_release\n                kfree(rdata)\n return rdata->...               # UAF in readpages_fill_pages()\n\nSimilarly, this problem also occurs in the uncache_fill_pages().\n\nFix this by adjusts the order of condition judgment in the return\nstatement."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"2b693fe3f760c87fd9768e759f6297f743a1b3b0","versionType":"git"},{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"d1fba1e096ffc7ec11df863a97c50203c47315b9","versionType":"git"},{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"3684a2f6affa1ca52a5d4a12f04d0652efdee65e","versionType":"git"},{"version":"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e","status":"affected","lessThan":"aa5465aeca3c66fecdf7efcf554aed79b4c4b211","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/file.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.17","versionType":"semver"},{"version":"5.10.168","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.94","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.12","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/file.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0"},{"url":"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9"},{"url":"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e"},{"url":"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The UAF is in the CIFS/SMB client's demultiplex path (cifs_demultiplex_thread → cifs_readv_receive → readpages_fill_pages) while consuming a remote SMB read response; a malicious or compromised file server (or on-path attacker) triggers reconnect by dropping/resetting TCP/445 mid-read, matching other cifs client reconnect UAFs scored AV:N.\nAC:L - The attacker fully controls when to abort the connection during an in-flight read and can refuse reconnect so __cifs_reconnect hits msleep(3000), giving the workqueue ample time to free rdata before the return accesses it; retries are unbounded.\nPR:N - The attacker is the remote SMB peer (or MITM) and needs no credentials or privileges on the victim client; abort/reconnect runs in the cifsd kernel thread from protocol/transport behavior alone.\nUI:N - Against an already-established CIFS mount (fstab, autofs, systemd automount, container share), normal client readahead/reads plus attacker-induced disconnects trigger the path with no victim action at exploit time.\nS:U - The freed cifs_readdata object and resulting heap corruption stay within the host kernel's security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of the heap-allocated rdata lets an attacker reclaim the slab and control the dangling rdata->got_bytes read (and related readdata state), yielding a kernel disclosure primitive per UAF guidance.\nI:H - The same UAF enables heap spraying/reclaim of cifs_readdata for write and control-flow hijack primitives, and a sprayed got_bytes can also divert post-reconnect mid handling into inconsistent success paths.\nA:H - The KASAN report shows a kernel use-after-free/oops in readpages_fill_pages on the freed rdata, so the bug denies availability even without further exploitation and is repeatedly triggerable by peer disconnects."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:11:10.506Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"5.10.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"5.15.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"6.1.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"6.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-52741","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-28T15:46:03.268177Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:24:17.508Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T23:11:35.667Z"}}]}}}