CVE-2023-1192: Use-after-free in smb2_is_status_io_timeout()
A use after free flaw was found in smb2isstatusiotimeout() in CIFS in the Linux Kernel.
When client uses CIFS, system calls about file operation will call cifs API to send samba request, and there is a CIFS kernel thread handler cifsdemultiplexthread() which receives response from remote server and transfer those data to corresponding syscall request.
After CIFS transfers response data to system call, there is still a local variable points to the memory region, and if system call frees it faster than CIFS uses it, CIFS will access a free memory region when calls function such as smb2isstatusiotimeout() .
Refer: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d527f51331cace562393a8038d870b3e9916686f
KASAN report
[ 83.686500] ================================================================== [ 83.686821] BUG: KASAN: use-after-free in smb2isstatusiotimeout+0x6e/0x70 [ 83.687136] Read of size 4 at addr ffff8880086d4808 by task cifsd/272 [ 83.687409] [ 83.687484] CPU: 1 PID: 272 Comm: cifsd Not tainted 6.0.6 #9 [ 83.687731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/04 [ 83.688081] Call Trace: [ 83.688209] <TASK> [ 83.688306] dumpstacklvl+0x34/0x48 [ 83.688472] printreport.cold+0x5e/0x5e5 [ 83.688652] ? smb2isstatusiotimeout+0x6e/0x70 [ 83.688864] kasanreport+0xa3/0x130 [ 83.689025] ? smb2isstatusiotimeout+0x6e/0x70 [ 83.689237] smb2isstatusiotimeout+0x6e/0x70 [ 83.689442] cifsdemultiplexthread+0xdbe/0x1db0 [ 83.689647] ? updateloadavg+0x124/0x19b0 [ 83.689817] ? cifshandlestandard+0x600/0x600 [ 83.689993] ? runrebalancedomains+0x180/0x180 [ 83.690172] ? updatecurr+0x233/0x520 [ 83.690330] ? schedule+0x885/0x1a80 [ 83.690488] ? rawspinlockirqsave+0x88/0xe0 [ 83.690679] ? cpuidletextend+0x1/0x1 [ 83.690838] ? kthreadparkme+0x7e/0x150 [ 83.691012] ? cifshandlestandard+0x600/0x600 [ 83.691204] kthread+0x267/0x300 [ 83.691338] ? kthreadcompleteandexit+0x20/0x20 [ 83.691542] retfromfork+0x22/0x30 [ 83.691688] </TASK> [ 83.691780] [ 83.691846] Allocated by task 272: [ 83.691985] kasansavestack+0x1e/0x40 [ 83.692142] kasanslaballoc+0x66/0x80 [ 83.692306] kmemcachealloc+0xbf/0x200 [ 83.692457] mempoolalloc+0xfe/0x2d0 [ 83.692598] cifssmallbufget+0x2e/0x80 [ 83.692752] allocatebuffers+0x10d/0x320 [ 83.692902] cifsdemultiplexthread+0x22e/0x1db0 [ 83.693082] kthread+0x267/0x300 [ 83.693218] retfromfork+0x22/0x30 [ 83.693374] [ 83.693443] Freed by task 399: [ 83.693576] kasansavestack+0x1e/0x40 [ 83.693743] kasansettrack+0x21/0x30 [ 83.693907] kasansetfreeinfo+0x20/0x40 [ 83.694083] kasanslabfree+0x108/0x190 [ 83.694261] kmemcachefree+0x9c/0x340 [ 83.694428] freerspbuf+0x4c/0xe0 [ 83.694579] SMB2open+0x1f6/0x17c0 [ 83.694731] smb2openfile+0x166/0x650 [ 83.694896] cifsopen+0x82d/0x1b20 [ 83.695048] dodentryopen+0x441/0x1020 [ 83.695219] pathopenat+0x1fbe/0x3850 [ 83.695385] dofilpopen+0x1ac/0x3e0 [ 83.695545] doopenexecat+0xb9/0x5a0 [ 83.695706] bprmexecve+0x35b/0x1250 [ 83.695867] doexecveatcommon.isra.0+0x4c6/0x660 [ 83.696073] x64sysexecve+0x83/0xb0 [ 83.696239] dosyscall64+0x3b/0x90 [ 83.696394] entrySYSCALL64afterhwframe+0x63/0xcd [ 83.696612] [ 83.696683] The buggy address belongs to the object at ffff8880086d4800 [ 83.696683] which belongs to the cache cifssmallrq of size 448 [ 83.697216] The buggy address is located 8 bytes inside of [ 83.697216] 448-byte region [ffff8880086d4800, ffff8880086d49c0) [ 83.697694] [ 83.697766] The buggy address belongs to the physical page: [ 83.698001] page:00000000eca794da refcount:1 mapcount:0 mapping:0000000000000000 inde4 [ 83.698401] head:00000000eca794da order:1 compoundmapcount:0 compoundpincount:0 [ 83.698716] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 83.698961] raw: 0100000000010200 0000000000000000 dead000000000122 ffff888007748b40 [ 83.699290] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 83.699616] page dumped because: kasan: bad access detected [ 83.699852] [ 83.699927] Memory state around the buggy address: [ 83.700130] ffff8880086d4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.700436] ffff8880086d4780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 83.700742] >ffff8880086d4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.701049] ^ [ 83.701205] ffff8880086d4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.701508] ffff8880086d4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.701813] ================================================================== [ 83.702134] Disabling lock debugging due to kernel taint
Other sources
A use-after-free flaw was found in smb2isstatusiotimeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.
— NVD
Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw in the smb2isstatusiotimeout() function in CIFS . By sending a specially crafted system call, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1192?
CVE-2023-1192 has been classified as a high severity vulnerability due to the potential for exploitation of the use after free flaw.
How do I fix CVE-2023-1192?
To fix CVE-2023-1192, update your Linux Kernel to version 6.4 or later, or apply the appropriate patches provided by your distribution.
Which systems are affected by CVE-2023-1192?
CVE-2023-1192 affects various versions of the Linux Kernel prior to 6.4, along with IBM Security Verify Governance components ISVG 10.0.2.
What are the potential impacts of CVE-2023-1192?
Exploitation of CVE-2023-1192 could lead to unauthorized access or remote code execution due to the use after free condition.
Is CVE-2023-1192 specific to certain distributions?
Yes, CVE-2023-1192 specifically affects Red Hat Enterprise Linux versions 8.0 and 9.0.