Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free. Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
316cf94a910f6f93d43cc574359d163ccae098a3 to < 9eed72e9534b10a6d9f8f5146feff3db53aebdbaaffected316cf94a910f6f93d43cc574359d163ccae098a3 to < 5e6533a683f6a851158d9f33fb4ea8f4f25d7f84affected316cf94a910f6f93d43cc574359d163ccae098a3 to < 730d0bb19507b9e19c2fe5343109ac618e2fbce5affected
Linux Linux
Default version status: affected
3.6affected0 to < 3.6unaffected6.18.51 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected