Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2023-53377

cifs: prevent use-after-free by freeing the cfile later

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on. This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 76894f3e2f71177747b8b4763fb180e800279585 to < 4fe07d55a5461e66a55fbefb57f85ff0facea32baffected
  • 76894f3e2f71177747b8b4763fb180e800279585 to < b6353518ef8180816e863aa23b06456f395404d6affected
  • 76894f3e2f71177747b8b4763fb180e800279585 to < d017880782cf71f8820ee4a2002843893176501daffected
  • 76894f3e2f71177747b8b4763fb180e800279585 to < 33f736187d08f6bc822117629f263b97d3df4165affected
  • 2d046892a493d9760c35fdaefc3017f27f91b621affected
  • 6.0.16 to < 6.1affected

Linux Linux

Default version status: affected

  • 6.1affected
  • 0 to < 6.1unaffected
  • 6.1.39 to ≤ 6.1.*unaffected
  • 6.3.13 to ≤ 6.3.*unaffected
  • 6.4.4 to ≤ 6.4.*unaffected
  • 6.5 to ≤ *unaffected

References