Описание
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free in SMB request handling
A race condition exists between SMB request handling in
ksmbd_conn_handler_loop() and the freeing of ksmbd_conn in the
workqueue handler handle_ksmbd_work(). This leads to a UAF.
- KASAN: slab-use-after-free Read in handle_ksmbd_work
- KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows:
ksmbd_conn_handler_loop()waits forconn->r_countto reach zero:wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);- Meanwhile,
handle_ksmbd_work()decrementsconn->r_countusingatomic_dec_return(&conn->r_count), and if it reaches zero, callsksmbd_conn_free(), which freesconn. - However, after
handle_ksmbd_work()decrementsconn->r_count, it may still accessconn->r_count_qin the following line:waitqueue_active(&conn->r_count_q)orwake_up(&conn->r_count_q)This results in a UAF, asconnhas already been freed. The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests.
A flaw was found in ksmbd, the in-kernel SMB server for Linux. A race condition exists during SMB request handling, where a connection object (ksmbd_conn) can be prematurely freed while still being accessed by the workqueue handler. A remote unauthenticated attacker could exploit this use-after-free vulnerability to cause a kernel crash, leading to a denial of service on the affected system.
Отчет
A race between ksmbd_conn_handler_loop() and handle_ksmbd_work() could free ksmbd_conn while the workqueue path still touches its waitqueue, causing a use-after-free and kernel crash. The patch adds a temporary reference (refcnt inc/dec) around the decrement of r_count and wakeup, preventing the UAF. Impact is remote denial of service against systems running and exposing ksmbd; no authentication is required, but reliable exploitation beyond DoS is non-trivial due to race timing.
Меры по смягчению последствий
To prevent the ksmbd kernel module from loading, blacklist it. Create /etc/modprobe.d/blacklist-ksmbd.conf with blacklist ksmbd and install ksmbd /bin/true. Then, update the initial RAM disk using dracut -f -v and reboot the system. This action will disable kernel SMB server functionality, which may affect systems dependent on ksmbd.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF, as `conn` has ...
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF, as
In the Linux kernel, the following vulnerability has been resolved: k ...
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF,...
EPSS
7 High
CVSS3