CVE-2024-53177

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: prevent use-after-free due to open_cached_dir error paths

If open_cached_dir() encounters an error parsing the lease from the

server, the error handling may race with receiving a lease break,

resulting in open_cached_dir() freeing the cfid while the queued work is

pending.

Update open_cached_dir() to drop refs rather than directly freeing the

cfid.

Have cached_dir_lease_break(), cfids_laundromat_worker(), and

invalidate_all_cached_dirs() clear has_lease immediately while still

holding cfids->cfid_list_lock, and then use this to also simplify the

reference counting in cfids_laundromat_worker() and

invalidate_all_cached_dirs().

Fixes this KASAN splat (which manually injects an error and lease break

in open_cached_dir()):

==================================================================

BUG: KASAN: slab-use-after-free in smb2_cached_lease_break+0x27/0xb0

Read of size 8 at addr ffff88811cc24c10 by task kworker/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References