CVE-2024-53095

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix use-after-free of network namespace.

Recently, we got a customer report that CIFS triggers oops while

reconnecting to a server. [0]

The workload runs on Kubernetes, and some pods mount CIFS servers

in non-root network namespaces. The problem rarely happened, but

it was always while the pod was dying.

The root cause is wrong reference counting for network namespace.

CIFS uses kernel sockets, which do not hold refcnt of the netns that

the socket belongs to. That means CIFS must ensure the socket is

always freed before its netns; otherwise, use-after-free happens.

The repro steps are roughly:

1. mount CIFS in a non-root netns

2. drop packets from the netns

3. destroy the netns

4. unmount CIFS

We can reproduce the issue quickly with the script [1] below and see

the splat [2] if CONFIG_NET_NS_REFCNT_TRACKER is enabled.

When the socket is TCP, it is hard to guarantee the netns lifetime

wi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References