Bug 2154178 (CVE-2023-1192) - CVE-2023-1192 kernel: use-after-free in smb2_is_status_io_timeout()
Summary: CVE-2023-1192 kernel: use-after-free in smb2_is_status_io_timeout()
Keywords:
Status: NEW
Alias: CVE-2023-1192
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2175613 2175614 2175615 2175616 2175617
Blocks: 2139758
TreeView+ depends on / blocked
 
Reported: 2022-12-16 06:05 UTC by TEJ RATHI
Modified: 2023-07-18 18:41 UTC (History)
37 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2022-12-16 06:05:24 UTC 
The use-after-free in smb2_is_status_io_timeout()

Local variable points to memory region which may be freed in other thread.
Comment 4 Rohit Keshri 2023-03-06 06:37:34 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2175613]
Comment 6 Alex 2023-03-06 08:40:14 UTC 
After CIFS transfers response data to system call, there is still a local variable points to the memory region, and if system call frees it faster than CIFS uses it, CIFS will access a free memory region when calls function such as `smb2_is_status_io_timeout()` .

For the Red Hat Enterprise Linux it is enabled as module:
CONFIG_CIFS=m

KSMBD and CIFS are the implementation of in-kernel samba server and CIFS, they are often disabled by default Linux configuration, but you can enable then by adding configuration below.

```
CONFIG_SMB_SERVER=y
CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=y

CONFIG_CIFS=y
CONFIG_CIFS_STATS2=y
CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y
CONFIG_CIFS_DEBUG=y
```
Comment 11 Marcus Meissner 2023-07-09 09:22:25 UTC 
Hi,

is there more information for this?

No related commit message can be found in the Linux Kernel.

if not, please reject the CVE.
Comment 12 Justin M. Forbes 2023-07-18 18:41:49 UTC 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=98bea253aa28ad8be2ce565a9ca21beb4a9419e5

This was fixed for Fedora with the 6.3.4 stable kernel update.
Note You need to log in before you can comment on or make changes to this bug.