Описание
Уязвимость функции clean_demultiplex_info() модуля fs/smb/client/connect.c поддержки клиента SMB ядра операционной системы Linux связана с некорректной блокировкой ресурсов. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании
Вендор
Наименование ПО
Версия ПО
Тип ПО
Операционные системы и аппаратные платформы
Уровень опасности уязвимости
Возможные меры по устранению уязвимости
Статус уязвимости
Наличие эксплойта
Информация об устранении
Ссылки на источники
Идентификаторы других систем описаний уязвимостей
- CVE
5.5 Medium
CVSS3
4.6 Medium
CVSS2
Связанные уязвимости
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
[REJECTED CVE] A vulnerability was suspected in the Linux kernel's SMB client module related to TCP timers and potential deadlocks after module removal (rmmod cifs). The issue stemmed from incorrect manual manipulation of sk->sk_net_refcnt, which led to TCP timers not being properly cleared, causing lockdep warnings and deadlocks. However, this was an internal kernel misconfiguration affecting cleanup behavior rather than a security flaw exploitable by an attacker. Since no privilege escalation or data exposure was possible, this does not qualify as a security vulnerability.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix TCP timers deadlock after rmmod Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") fixed a netns UAF by manually enabled socket refcounting (sk->sk_net_refcnt=1 and sock_inuse_add(net, 1)). The reason the patch worked for that bug was because we now hold references to the netns (get_net_track() gets a ref internally) and they're properly released (internally, on __sk_destruct()), but only because sk->sk_net_refcnt was set. Problem: (this happens regardless of CONFIG_NET_NS_REFCNT_TRACKER and regardless if init_net or other) Setting sk->sk_net_refcnt=1 *manually* and *after* socket creation is not only out of cifs scope, but also technically wrong -- it's set conditionally based on user (=1) vs kernel (=0) sockets. And net/ implementations seem to base their user vs kernel space operations on it. e.g. upon TCP socket close, the TCP timers are not cleared because sk->...
5.5 Medium
CVSS3
4.6 Medium
CVSS2