Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. The existing checks on fp->refcount are not sufficient to prevent this. The fix takes ft->lock around the section which removes the file from the file table. This prevents two threads acquiring the same file pointer via __close_file_table_ids, as well as the other functions which retrieve a file from the IDR and which already use this same lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0626e6641f6b467447c81dd7678a69c66f7746cf to < 21100812657965dd95bc305f6076f62012f34cf4affected0626e6641f6b467447c81dd7678a69c66f7746cf to < fec1f9e9a650e8e7011330a085c77e7bf2a08ea9affected0626e6641f6b467447c81dd7678a69c66f7746cf to < 9e9841e232b51171ddf3bc4ee517d5d28dc8cad6affected0626e6641f6b467447c81dd7678a69c66f7746cf to < 16727e442568a46d9cca69fe2595896de86e120daffected0626e6641f6b467447c81dd7678a69c66f7746cf to < 36991c1ccde2d5a521577c448ffe07fcccfe104daffected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected6.1.191 to ≤ 6.1.*unaffected6.6.91 to ≤ 6.6.*unaffected6.12.29 to ≤ 6.12.*unaffected6.14.7 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/21100812657965dd95bc305f6076f62012f34cf4 ↗
- https://git.kernel.org/stable/c/fec1f9e9a650e8e7011330a085c77e7bf2a08ea9 ↗
- https://git.kernel.org/stable/c/9e9841e232b51171ddf3bc4ee517d5d28dc8cad6 ↗
- https://git.kernel.org/stable/c/16727e442568a46d9cca69fe2595896de86e120d ↗
- https://git.kernel.org/stable/c/36991c1ccde2d5a521577c448ffe07fcccfe104d ↗