Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids() A ksmbd_file can remain alive after logical close while another session holds a temporary reference obtained through ksmbd_lookup_fd_inode(). ksmbd_close_fd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped. If the foreign holder performs the final ksmbd_fd_put(), __put_fd_final() supplies the foreign session's file table to __ksmbd_close_fd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown. Remove the volatile id from the owner's idr while ksmbd_close_fd() still holds that table's lock, and clear volatile_id before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8510a043d334ecdf83d4604782f288db6bf21d60 to < 19bfd90d5aaf63217735d81964585c5306158e5faffected8510a043d334ecdf83d4604782f288db6bf21d60 to < 67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cdaffected8510a043d334ecdf83d4604782f288db6bf21d60 to < 0c3918c2cee62ec6c9de8d5c73ebfe6f833961acaffected8510a043d334ecdf83d4604782f288db6bf21d60 to < 9be4a66f019ea90bd9deca70511f4f9ffebf5c6faffected8510a043d334ecdf83d4604782f288db6bf21d60 to < cffbdc86393b0235383a20c8c59bc32f16036459affected8510a043d334ecdf83d4604782f288db6bf21d60 to < e7188199eff46a636f3436356f0aae039be6dd66affecteddf30cbfd3d8a70e61ce59f63ce5ed2261799ac10affectedaaf1d5ebb358f546414965b39da90107a7ca7ce5affected5.15.38 to < 5.16affected5.17.6 to < 5.18affected
Linux Linux
Default version status: affected
5.18affected0 to < 5.18unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/19bfd90d5aaf63217735d81964585c5306158e5f ↗
- https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd ↗
- https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac ↗
- https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f ↗
- https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459 ↗
- https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66 ↗