Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race condition between ksmbd_session_lookup and ksmbd_expire_session.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected a6a9601ba995d0fec635324cb9fd8d14f9bea14e before c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f; affected 1fc8a2b14ef5223f8e0b95faba2ee0a6e4d0f99d before a2ca5fd3dbcc665e1169044fa0c9e3eba779202b; affected ea174a91893956450510945a0c5d1a10b5323656 before 18ced78b0ebccc2d16f426143dc56ab3aad666be; affected ea174a91893956450510945a0c5d1a10b5323656 before 53ff5cf89142b978b1a5ca8dc4d4425e6a09745f; affected 750a2d772e9d9ff377fd32e3b6797bf2cd847a7a; affected 6775ee7ef4b37c521aa4cf3730f54554c4875542; affected 6.1.29 before 6.1.57; affected 6.2.16 before 6.3; affected 6.3.2 before 6.4 |
| Linux / Linux | affected 6.4; unaffected 0 before 6.4; unaffected 6.1.57 through 6.1.*; unaffected 6.5.7 through 6.5.*; unaffected 6.6 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f
- https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b
- https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be
- https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.