CVE-2024-46796

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double put of @cfile in smb2_set_path_size()

If smb2_compound_op() is called with a valid @cfile and returned

-EINVAL, we need to call cifs_get_writable_path() before retrying it

as the reference of @cfile was already dropped by previous call.

This fixes the following KASAN splat when running fstests generic/013

against Windows Server 2022:

CIFS: Attempting to mount //w22-fs0/scratch

run fstests generic/013 at 2024-09-02 19:48:59

==================================================================

BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200

Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176

CPU: 3 UID: 0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40

04/01/2014

Workqueue: cifsoplockd cifs_oplock_break [cifs]

Call Trace:

<TASK>

dump_stack_lvl+0x5d/0x80

? detach_i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References