UBUNTU-CVE-2023-52741
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: <TASK> dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... # UAF in readpages_fill_pages() Similarly, this problem also occurs in the uncache_fill_pages(). Fix this by adjusts the order of condition judgment in the return statement.
02 / AFFECTED SOFTWARE
Affected packages
39 explicit affected versions
12 explicit affected versions
20 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
6 explicit affected versions
29 explicit affected versions
15 explicit affected versions
76 explicit affected versions
26 explicit affected versions
15 explicit affected versions
21 explicit affected versions
191 explicit affected versions
7 explicit affected versions
23 explicit affected versions
104 explicit affected versions
71 explicit affected versions
35 explicit affected versions
18 explicit affected versions
102 explicit affected versions
10 explicit affected versions
106 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
107 explicit affected versions
1 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
60 explicit affected versions
7 explicit affected versions
12 explicit affected versions
13 explicit affected versions
12 explicit affected versions
7 explicit affected versions
93 explicit affected versions
12 explicit affected versions
109 explicit affected versions
117 explicit affected versions
12 explicit affected versions
104 explicit affected versions
106 explicit affected versions
10 explicit affected versions
174 explicit affected versions
37 explicit affected versions
10 explicit affected versions
4 explicit affected versions
1 explicit affected versions
26 explicit affected versions
13 explicit affected versions
1 explicit affected versions
29 explicit affected versions
96 explicit affected versions
13 explicit affected versions
26 explicit affected versions
1 explicit affected versions
87 explicit affected versions
25 explicit affected versions
108 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
100 explicit affected versions
11 explicit affected versions
12 explicit affected versions
123 explicit affected versions
7 explicit affected versions
12 explicit affected versions
107 explicit affected versions
2 explicit affected versions
15 explicit affected versions
7 explicit affected versions
116 explicit affected versions
23 explicit affected versions
151 explicit affected versions
137 explicit affected versions
10 explicit affected versions
26 explicit affected versions
41 explicit affected versions
13 explicit affected versions
123 explicit affected versions
64 explicit affected versions
16 explicit affected versions
26 explicit affected versions
16 explicit affected versions
3 explicit affected versions
77 explicit affected versions
1 explicit affected versions
74 explicit affected versions
51 explicit affected versions
76 explicit affected versions
12 explicit affected versions
14 explicit affected versions
27 explicit affected versions
3 explicit affected versions
1 explicit affected versions
1 explicit affected versions
81 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
96 explicit affected versions
13 explicit affected versions
59 explicit affected versions
7 explicit affected versions
78 explicit affected versions
18 explicit affected versions
10 explicit affected versions
3 explicit affected versions
12 explicit affected versions
94 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
12 explicit affected versions
37 explicit affected versions
38 explicit affected versions
16 explicit affected versions
9 explicit affected versions
16 explicit affected versions
11 explicit affected versions
23 explicit affected versions
7 explicit affected versions
84 explicit affected versions
67 explicit affected versions
127 explicit affected versions
106 explicit affected versions
4 explicit affected versions
21 explicit affected versions
99 explicit affected versions
43 explicit affected versions
62 explicit affected versions
130 explicit affected versions
151 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
92 explicit affected versions
4 explicit affected versions
78 explicit affected versions
1 explicit affected versions
53 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: <TASK> dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... # UAF in readpages_fill_pages() Similarly, this problem also occurs in the uncache_fill_pages(). Fix this by adjusts the order of condition judgment in the return statement.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/aa5465aeca3c66fecdf7efcf554aed79b4c4b211
- https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0
- https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e
- https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211
- https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9
- https://ubuntu.com/security/CVE-2023-52741
- https://ubuntu.com/security/notices/USN-7496-1
- https://ubuntu.com/security/notices/USN-7496-3
- https://ubuntu.com/security/notices/USN-7496-4
- https://ubuntu.com/security/notices/USN-7496-5
- https://ubuntu.com/security/notices/USN-7506-1
- https://ubuntu.com/security/notices/USN-7506-2
- https://ubuntu.com/security/notices/USN-7506-3
- https://ubuntu.com/security/notices/USN-7506-4
- https://ubuntu.com/security/notices/USN-7516-1
- https://ubuntu.com/security/notices/USN-7516-2
- https://ubuntu.com/security/notices/USN-7516-3
- https://ubuntu.com/security/notices/USN-7516-4
- https://ubuntu.com/security/notices/USN-7516-5
- https://ubuntu.com/security/notices/USN-7516-6
- https://ubuntu.com/security/notices/USN-7516-7
- https://ubuntu.com/security/notices/USN-7516-8
- https://ubuntu.com/security/notices/USN-7516-9
- https://ubuntu.com/security/notices/USN-7517-1
- https://ubuntu.com/security/notices/USN-7517-2
- https://ubuntu.com/security/notices/USN-7517-3
- https://ubuntu.com/security/notices/USN-7518-1
- https://ubuntu.com/security/notices/USN-7539-1
- https://ubuntu.com/security/notices/USN-7540-1
- https://ubuntu.com/security/notices/USN-7640-1
- https://www.cve.org/CVERecord?id=CVE-2023-52741