Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
54be1f6c1c37498bba557049df646cc239fa37e3 to < 14f60e959b5ac813715ff72e127beb3584ddabf6affected54be1f6c1c37498bba557049df646cc239fa37e3 to < 3ff9462bb7a06d8d32a1dc02d39580b078ec9e55affected54be1f6c1c37498bba557049df646cc239fa37e3 to < 7507bd1885643d0461a6017767492450af1ce2a3affected54be1f6c1c37498bba557049df646cc239fa37e3 to < 9ab46a13798a61d9d020b01d4e57efdabe6624faaffected54be1f6c1c37498bba557049df646cc239fa37e3 to < 5baab40404a9393bcc0b7b8f1950bf2c307e0984affected54be1f6c1c37498bba557049df646cc239fa37e3 to < b1b741cf8e7ce1b91d937e23decd3d3358748700affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/14f60e959b5ac813715ff72e127beb3584ddabf6 ↗
- https://git.kernel.org/stable/c/3ff9462bb7a06d8d32a1dc02d39580b078ec9e55 ↗
- https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3 ↗
- https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa ↗
- https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984 ↗
- https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700 ↗