Bug 2242172 (CVE-2023-5345) - CVE-2023-5345 kernel: use-after-free vulnerability in the smb client component
Summary: CVE-2023-5345 kernel: use-after-free vulnerability in the smb client component
Keywords:
Status: NEW
Alias: CVE-2023-5345
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2242280
Blocks: 2242170
TreeView+ depends on / blocked
 
Reported: 2023-10-04 17:59 UTC by Patrick Del Bello
Modified: 2026-05-29 04:47 UTC (History)
39 users (show)

Fixed In Version: kernel 6.6-rc4
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:7734 0 None None None 2023-12-12 10:54:43 UTC
Red Hat Product Errata RHSA-2023:7749 0 None None None 2023-12-12 17:22:25 UTC

Description Patrick Del Bello 2023-10-04 17:59:03 UTC
A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.
In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.
We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6e43b8aa7cd3c3af686caf0c2e11819a886d705
https://kernel.dance/e6e43b8aa7cd3c3af686caf0c2e11819a886d705

Comment 5 Mauro Matteo Cascella 2023-10-05 10:17:19 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2242280]

Comment 12 Ricky 2023-11-04 10:16:59 UTC Comment hidden (spam)
Comment 16 errata-xmlrpc 2023-12-12 10:54:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7734 https://access.redhat.com/errata/RHSA-2023:7734

Comment 17 errata-xmlrpc 2023-12-12 17:22:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:7749 https://access.redhat.com/errata/RHSA-2023:7749

Comment 19 https://bugzilla.redhat.com/token.cgi?t=EHHR24Xeyi&a=request_new_account 2024-04-26 19:22:13 UTC Comment hidden (spam)
Comment 21 Withre 2025-07-15 11:29:36 UTC Comment hidden (spam)
Comment 22 Withre 2025-07-16 06:20:30 UTC Comment hidden (spam)
Comment 30 Muslim Writer 2026-05-17 04:33:57 UTC
This type of issue in the Linux kernel SMB client (use-after-free in fs/smb/client) is really concerning because it shows how a small memory handling mistake can escalate into a local privilege escalation risk. In many real environments, especially multi-user or server systems, these kinds of bugs can be silently exploited if patches are delayed.

Proper kernel updates and secure build configurations are really the only reliable mitigation here, since user-space controls don’t fully reduce the attack surface once SMB client code is involved. I’ve also seen some practical security-related notes and resources being shared here for similar Linux vulnerabilities, for example at <a href="https://stickwarlegacyapps.org/">stickwarlegacyapps</a> which discusses system security topics in a simplified way for awareness.

Comment 31 Muslim Writer 2026-05-17 04:39:25 UTC
This issue in the Linux kernel SMB client (use-after-free in fs/smb/client) is concerning because even small memory handling bugs can potentially lead to local privilege escalation in real systems. In multi-user or server environments, such vulnerabilities can be exploited if kernel updates are delayed. The safest mitigation is keeping the system fully patched and properly secured, and for general awareness, resources like https://gtasandresapk.com/ Security Resources provide simplified discussions on similar security topics.

Comment 32 Muslim Writer 2026-05-29 04:47:19 UTC
This appears to be another SMB client memory-management issue where improper cleanup can lead to a use-after-free condition under specific error paths. Applying the latest kernel patches is probably the safest mitigation for now. I also found some useful community-shared debugging discussions around similar cases at https://tocabocamodapps.com/.


Note You need to log in before you can comment on or make changes to this bug.