Bug 2242172 (CVE-2023-5345)

Summary:	CVE-2023-5345 kernel: use-after-free vulnerability in the smb client component
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, dbohanno, debarbos, dfreiber, drow, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jfaracco, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, ldoskova, lgoncalv, m65015482, mcascell, nmurray, ptalbert, rogbas, rparrazo, rrobaina, rvrbovsk, scweaver, tglozar, vkumar, wcosta, williams, wmealing, ycote, ykopkova
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.6-rc4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the SMB client component in the Linux kernel. In case of an error in smb3_fs_context_parse_param, `ctx->password` was freed, but the field was not set to NULL, potentially leading to a use-after-free vulnerability. This flaw allows a local user to crash or potentially escalate their privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2242280
Bug Blocks:	2242170

Description Patrick Del Bello 2023-10-04 17:59:03 UTC

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.
In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.
We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6e43b8aa7cd3c3af686caf0c2e11819a886d705
https://kernel.dance/e6e43b8aa7cd3c3af686caf0c2e11819a886d705

Comment 5 Mauro Matteo Cascella 2023-10-05 10:17:19 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2242280]

Comment 12 Ricky 2023-11-04 10:16:59 UTC Comment hidden (spam)

A use-after-free vulnerability in the Linux kernel's SMB client component, potentially allowing privilege escalation.
https://mycenturahealth.site/

Comment 16 errata-xmlrpc 2023-12-12 10:54:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7734 https://access.redhat.com/errata/RHSA-2023:7734

Comment 17 errata-xmlrpc 2023-12-12 17:22:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7749 https://access.redhat.com/errata/RHSA-2023:7749

Comment 19 https://bugzilla.redhat.com/token.cgi?t=EHHR24Xeyi&a=request_new_account 2024-04-26 19:22:13 UTC Comment hidden (spam)

The https://mycenturahealth.click/ patient portal is a convenient tool to help you manage your health online. Once you’ve registered, you can view your past medical history, check current lab results, and pay your medical bills online. You can also order and request prescriptions, get your immunizations, and receive reminders about upcoming appointments and tests.

Comment 21 Withre 2025-07-15 11:29:36 UTC Comment hidden (spam)

This is a great post. I like this topic. I found many interesting things on this site. Thanks for posting this.

Comment 22 Withre 2025-07-16 06:20:30 UTC Comment hidden (spam)

This is a great post. I like this topic. I found many interesting things on this site. Thanks for posting this.

https://osceolacountypropertyappraiser.org

Comment 30 Muslim Writer 2026-05-17 04:33:57 UTC

This type of issue in the Linux kernel SMB client (use-after-free in fs/smb/client) is really concerning because it shows how a small memory handling mistake can escalate into a local privilege escalation risk. In many real environments, especially multi-user or server systems, these kinds of bugs can be silently exploited if patches are delayed.

Proper kernel updates and secure build configurations are really the only reliable mitigation here, since user-space controls don’t fully reduce the attack surface once SMB client code is involved. I’ve also seen some practical security-related notes and resources being shared here for similar Linux vulnerabilities, for example at <a href="https://stickwarlegacyapps.org/">stickwarlegacyapps</a> which discusses system security topics in a simplified way for awareness.

Comment 31 Muslim Writer 2026-05-17 04:39:25 UTC

This issue in the Linux kernel SMB client (use-after-free in fs/smb/client) is concerning because even small memory handling bugs can potentially lead to local privilege escalation in real systems. In multi-user or server environments, such vulnerabilities can be exploited if kernel updates are delayed. The safest mitigation is keeping the system fully patched and properly secured, and for general awareness, resources like https://gtasandresapk.com/ Security Resources provide simplified discussions on similar security topics.

Comment 32 Muslim Writer 2026-05-29 04:47:19 UTC

This appears to be another SMB client memory-management issue where improper cleanup can lead to a use-after-free condition under specific error paths. Applying the latest kernel patches is probably the safest mitigation for now. I also found some useful community-shared debugging discussions around similar cases at https://tocabocamodapps.com/.