Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumeration state. The lock covers scan restart, dot entry state, readdir_data setup and iteration, and response construction. This prevents another request from replacing readdir_data.private before the current request has finished using it and also serializes the shared file position.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 1426fd79102539bc0ab5c8fced047ad4313b9908affectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 2a64dbf9c739ddf7a25a066507597bf89f8f73d2affectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 64dac2d486ec1eb18dc00968b16a230b6b75ec24affectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199affectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < fd22b039a5a05bc1d6818e9dcd1001fb432a829daffectede2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < be6d26bf27499977c746abc163659915082348d8affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908 ↗
- https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2 ↗
- https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24 ↗
- https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199 ↗
- https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d ↗
- https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8 ↗