|
Vulnerabilities
< Back

CVE-2023-52741

Updated on 21 May 2024

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix use-after-free in rdata->read_into_pages()

When the network status is unstable, use-after-free may occur when read data from the server.

BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0

Call Trace: dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50

Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc

Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50

Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50

The following function calls will cause UAF of the rdata pointer.

readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() –> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first,

the rdata is freed

cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->… # UAF in readpages_fill_pages()

Similarly, this problem also occurs in the uncache_fill_pages().

Fix this by adjusts the order of condition judgment in the return statement.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 6 ELS , CloudLinux 7 ELS , Debian 10 ELS , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
linux-meta @ 4.4.0 (+21 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 2023 Planned —
Amazon Linux 2 5.10 Will Not Fix —
CentOS 7 ELS Released
30 kernels
  • 3.10.0-1160.119.1.el7.tuxcare.els10
  • 3.10.0-1160.119.1.el7.tuxcare.els4
  • 3.10.0-1160.119.1.el7.tuxcare.els6
  • 3.10.0-1160.119.1.el7.tuxcare.els15
  • 3.10.0-1160.119.1.el7.tuxcare.els5
  • 3.10.0-1160.119.1.el7.tuxcare.els3
  • 3.10.0-1160.119.1.el7.tuxcare.els14
  • 3.10.0-1160.119.1.el7.tuxcare.els16
  • 3.10.0-1160.119.1.el7.tuxcare.els13
  • 3.10.0-1160.119.1.el7.tuxcare.els7
  • 3.10.0-1160.119.1.el7.tuxcare.els12
  • 3.10.0-1160.119.1.el7.tuxcare.els9
  • 3.10.0-1160.119.1.el7.tuxcare.els8
  • 3.10.0-1160.119.1.el7.tuxcare.els17
  • 3.10.0-1160.119.1.el7.tuxcare.els18
  • 3.10.0-1160.119.1.el7.tuxcare.els19
  • 3.10.0-1160.119.1.el7.tuxcare.els20
  • 3.10.0-1160.119.1.el7.tuxcare.els21
  • 3.10.0-1160.119.1.el7.tuxcare.els24
  • 3.10.0-1160.119.1.el7.tuxcare.els22
  • 3.10.0-1160.119.1.el7.tuxcare.els25
  • 3.10.0-1160.139.1.el7.tuxcare.els2
  • 3.10.0-1160.139.1.el7.tuxcare.els3
  • 3.10.0-1160.139.1.el7.tuxcare.els4
  • 3.10.0-1160.142.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els2
  • 3.10.0-1160.144.1.el7.tuxcare.els3
  • 3.10.0-1160.144.1.el7.tuxcare.els4
  • 3.10.0-1160.144.1.el7.tuxcare.els5
Ubuntu 16.04 AWS ESM Will Not Fix —
Ubuntu 16.04 AWS HWE ESM Will Not Fix —
Ubuntu 16.04 Azure ESM Will Not Fix —
Ubuntu 16.04 ESM Will Not Fix —
Ubuntu 16.04 GCP ESM Will Not Fix —
Ubuntu 16.04 HWE ESM Will Not Fix —
Ubuntu 18.04 Will Not Fix —
Ubuntu 18.04 AWS Focal Released
56 kernels
  • 5.4.0-1030.31~18.04.1
  • 5.4.0-1028.29~18.04.1
  • 5.4.0-1025.25~18.04.1
  • 5.4.0-1034.35~18.04.1
  • 5.4.0-1032.33~18.04.1
  • 5.4.0-1026.26~18.04.1
  • 5.4.0-1029.30~18.04.1
  • 5.4.0-1031.32~18.04.1
  • 5.4.0-1033.34~18.04.1
  • 5.4.0-1035.37~18.04.1
  • 5.4.0-1037.39~18.04.1
  • 5.4.0-1038.40~18.04.1
  • 5.4.0-1039.41~18.04.1
  • 5.4.0-1041.43~18.04.1
  • 5.4.0-1043.45~18.04.1
  • 5.4.0-1045.47~18.04.1
  • 5.4.0-1047.49~18.04.1
  • 5.4.0-1048.50~18.04.1
  • 5.4.0-1049.51~18.04.1
  • 5.4.0-1051.53~18.04.1
  • 5.4.0-1054.57~18.04.1
  • 5.4.0-1055.58~18.04.1
  • 5.4.0-1056.59~18.04.1
  • 5.4.0-1057.60~18.04.1
  • 5.4.0-1058.61~18.04.3
  • 5.4.0-1059.62~18.04.1
  • 5.4.0-1060.63~18.04.1
  • 5.4.0-1061.64~18.04.1
  • 5.4.0-1063.66~18.04.1
  • 5.4.0-1064.67~18.04.1
  • 5.4.0-1068.72~18.04.1
  • 5.4.0-1066.69~18.04.1
  • 5.4.0-1065.68~18.04.1
  • 5.4.0-1069.73~18.04.1
  • 5.4.0-1071.76~18.04.1
  • 5.4.0-1072.77~18.04.1
  • 5.4.0-1075.80~18.04.1
  • 5.4.0-1078.84~18.04.1
  • 5.4.0-1080.87~18.04.1
  • 5.4.0-1073.78~18.04.1
  • 5.4.0-1081.88~18.04.1
  • 5.4.0-1083.90~18.04.1
  • 5.4.0-1084.91~18.04.1
  • 5.4.0-1085.92~18.04.1
  • 5.4.0-1086.93~18.04.1
  • 5.4.0-1088.96~18.04.1
  • 5.4.0-1089.97~18.04.1
  • 5.4.0-1092.100~18.04.2
  • 5.4.0-1093.102~18.04.2
  • 5.4.0-1094.102~18.04.1
  • 5.4.0-1096.104~18.04.1
  • 5.4.0-1097.105~18.04.1
  • 5.4.0-1099.107~18.04.1
  • 5.4.0-1100.108~18.04.1
  • 5.4.0-1101.109~18.04.1
  • 5.4.0-1103.111~18.04.1
Ubuntu 18.04 HWE Focal Released
69 kernels
  • 5.4.0-53.59~18.04.1
  • 5.4.0-56.62~18.04.1
  • 5.4.0-45.49~18.04.2
  • 5.4.0-51.56~18.04.1
  • 5.4.0-48.52~18.04.1
  • 5.4.0-47.51~18.04.1
  • 5.4.0-52.57~18.04.1
  • 5.4.0-59.65~18.04.1
  • 5.4.0-62.70~18.04.1
  • 5.4.0-44.48~18.04.1
  • 5.4.0-46.50~18.04.1
  • 5.4.0-49.53~18.04.1
  • 5.4.0-54.60~18.04.1
  • 5.4.0-55.61~18.04.1
  • 5.4.0-57.63~18.04.1
  • 5.4.0-58.64~18.04.1
  • 5.4.0-60.67~18.04.1
  • 5.4.0-63.71~18.04.1
  • 5.4.0-64.72~18.04.1
  • 5.4.0-65.73~18.04.1
  • 5.4.0-66.74~18.04.2
  • 5.4.0-67.75~18.04.1
  • 5.4.0-70.78~18.04.1
  • 5.4.0-71.79~18.04.1
  • 5.4.0-72.80~18.04.1
  • 5.4.0-73.82~18.04.1
  • 5.4.0-74.83~18.04.1
  • 5.4.0-77.86~18.04.1
  • 5.4.0-80.90~18.04.1
  • 5.4.0-81.91~18.04.1
  • 5.4.0-84.94~18.04.1
  • 5.4.0-86.97~18.04.1
  • 5.4.0-87.98~18.04.1
  • 5.4.0-89.100~18.04.1
  • 5.4.0-90.101~18.04.1
  • 5.4.0-91.102~18.04.1
  • 5.4.0-92.103~18.04.2
  • 5.4.0-94.106~18.04.1
  • 5.4.0-96.109~18.04.1
  • 5.4.0-97.110~18.04.1
  • 5.4.0-99.112~18.04.1
  • 5.4.0-100.113~18.04.1
  • 5.4.0-104.118~18.04.1
  • 5.4.0-105.119~18.04.1
  • 5.4.0-107.121~18.04.1
  • 5.4.0-109.123~18.04.1
  • 5.4.0-110.124~18.04.1
  • 5.4.0-113.127~18.04.1
  • 5.4.0-117.132~18.04.1
  • 5.4.0-121.137~18.04.1
  • 5.4.0-120.136~18.04.1
  • 5.4.0-122.138~18.04.1
  • 5.4.0-124.140~18.04.1
  • 5.4.0-125.141~18.04.1
  • 5.4.0-126.142~18.04.1
  • 5.4.0-128.144~18.04.1
  • 5.4.0-131.147~18.04.1
  • 5.4.0-132.148~18.04.1
  • 5.4.0-133.149~18.04.1
  • 5.4.0-135.152~18.04.2
  • 5.4.0-136.153~18.04.1
  • 5.4.0-137.154~18.04.1
  • 5.4.0-139.156~18.04.1
  • 5.4.0-144.161~18.04.1
  • 5.4.0-146.163~18.04.1
  • 5.4.0-147.164~18.04.1
  • 5.4.0-148.165~18.04.1
  • 5.4.0-149.166~18.04.1
  • 5.4.0-150.167~18.04.1
Ubuntu 20.04 Released
126 kernels
  • 5.4.0-31.35
  • 5.4.0-28.32
  • 5.4.0-34.38
  • 5.4.0-26.30
  • 5.4.0-29.33
  • 5.4.0-30.34
  • 5.4.0-37.41
  • 5.4.0-40.44
  • 5.4.0-32.36
  • 5.4.0-33.37
  • 5.4.0-38.42
  • 5.4.0-39.43
  • 5.4.0-42.46
  • 5.4.0-45.49
  • 5.4.0-47.51
  • 5.4.0-48.52
  • 5.4.0-43.47
  • 5.4.0-44.48
  • 5.4.0-51.56
  • 5.4.0-49.53
  • 5.4.0-52.57
  • 5.4.0-53.59
  • 5.4.0-54.60
  • 5.4.0-56.62
  • 5.4.0-58.64
  • 5.4.0-46.50
  • 5.4.0-55.61
  • 5.4.0-57.63
  • 5.4.0-59.65
  • 5.4.0-60.67
  • 5.4.0-62.70
  • 5.4.0-64.72
  • 5.4.0-61.69
  • 5.4.0-63.71
  • 5.4.0-65.73
  • 5.4.0-66.74
  • 5.4.0-67.75
  • 5.4.0-70.78
  • 5.4.0-71.79
  • 5.4.0-72.80
  • 5.4.0-73.82
  • 5.4.0-74.83
  • 5.4.0-77.86
  • 5.4.0-80.90
  • 5.4.0-81.91
  • 5.4.0-84.94
  • 5.4.0-86.97
  • 5.4.0-88.99
  • 5.4.0-89.100
  • 5.4.0-90.101
  • 5.4.0-91.102
  • 5.4.0-92.103
  • 5.4.0-94.106
  • 5.4.0-96.109
  • 5.4.0-97.110
  • 5.4.0-99.112
  • 5.4.0-100.113
  • 5.4.0-104.118
  • 5.4.0-105.119
  • 5.4.0-107.121
  • 5.4.0-109.123
  • 5.4.0-110.124
  • 5.4.0-113.127
  • 5.4.0-117.132
  • 5.4.0-121.137
  • 5.4.0-120.136
  • 5.4.0-112.126
  • 5.4.0-122.138
  • 5.4.0-124.140
  • 5.4.0-125.141
  • 5.4.0-126.142
  • 5.4.0-128.144
  • 5.4.0-131.147
  • 5.4.0-132.148
  • 5.4.0-133.149
  • 5.4.0-135.152
  • 5.4.0-136.153
  • 5.4.0-137.154
  • 5.4.0-139.156
  • 5.4.0-144.161
  • 5.4.0-123.139
  • 5.4.0-146.163
  • 5.4.0-147.164
  • 5.4.0-148.165
  • 5.4.0-149.166
  • 5.4.0-150.167
  • 5.4.0-145.162
  • 5.4.0-152.169
  • 5.4.0-153.170
  • 5.4.0-155.172
  • 5.4.0-156.173
  • 5.4.0-159.176
  • 5.4.0-162.179
  • 5.4.0-163.180
  • 5.4.0-164.181
  • 5.4.0-165.182
  • 5.4.0-166.183
  • 5.4.0-167.184
  • 5.4.0-169.187
  • 5.4.0-170.188
  • 5.4.0-171.189
  • 5.4.0-172.190
  • 5.4.0-173.191
  • 5.4.0-174.193
  • 5.4.0-176.196
  • 5.4.0-177.197
  • 5.4.0-181.201
  • 5.4.0-182.202
  • 5.4.0-186.206
  • 5.4.0-187.207
  • 5.4.0-189.209
  • 5.4.0-190.210
  • 5.4.0-192.212
  • 5.4.0-193.213
  • 5.4.0-195.215
  • 5.4.0-196.216
  • 5.4.0-198.218
  • 5.4.0-200.220
  • 5.4.0-202.222
  • 5.4.0-204.224
  • 5.4.0-205.225
  • 5.4.0-208.228
  • 5.4.0-211.231
  • 5.4.0-212.232
  • 5.4.0-214.234
  • 5.4.0-215.235
Ubuntu 20.04 AWS Released
108 kernels
  • 5.4.0-1030.31
  • 5.4.0-1022.22
  • 5.4.0-1028.29
  • 5.4.0-1025.25
  • 5.4.0-1020.20
  • 5.4.0-1024.24
  • 5.4.0-1018.18
  • 5.4.0-1011.11
  • 5.4.0-1015.15
  • 5.4.0-1034.35
  • 5.4.0-1032.33
  • 5.4.0-1021.21
  • 5.4.0-1023.23
  • 5.4.0-1026.26
  • 5.4.0-1029.30
  • 5.4.0-1031.32
  • 5.4.0-1033.34
  • 5.4.0-1035.37
  • 5.4.0-1036.38
  • 5.4.0-1037.39
  • 5.4.0-1017.17
  • 5.4.0-1038.40
  • 5.4.0-1039.41
  • 5.4.0-1041.43
  • 5.4.0-1016.16
  • 5.4.0-1019.19
  • 5.4.0-1043.45
  • 5.4.0-1045.47
  • 5.4.0-1047.49
  • 5.4.0-1048.50
  • 5.4.0-1049.51
  • 5.4.0-1051.53
  • 5.4.0-1054.57
  • 5.4.0-1055.58
  • 5.4.0-1056.59
  • 5.4.0-1057.60
  • 5.4.0-1058.61
  • 5.4.0-1059.62
  • 5.4.0-1060.63
  • 5.4.0-1061.64
  • 5.4.0-1063.66
  • 5.4.0-1064.67
  • 5.4.0-1068.72
  • 5.4.0-1066.69
  • 5.4.0-1069.73
  • 5.4.0-1065.68
  • 5.4.0-1071.76
  • 5.4.0-1072.77
  • 5.4.0-1073.78
  • 5.4.0-1075.80
  • 5.4.0-1078.84
  • 5.4.0-1080.87
  • 5.4.0-1074.79
  • 5.4.0-1081.88
  • 5.4.0-1083.90
  • 5.4.0-1084.91
  • 5.4.0-1085.92
  • 5.4.0-1086.93
  • 5.4.0-1088.96
  • 5.4.0-1089.97
  • 5.4.0-1092.100
  • 5.4.0-1093.101
  • 5.4.0-1094.102
  • 5.4.0-1096.104
  • 5.4.0-1097.105
  • 5.4.0-1099.107
  • 5.4.0-1100.108
  • 5.4.0-1101.109
  • 5.4.0-1102.110
  • 5.4.0-1103.111
  • 5.4.0-1104.112
  • 5.4.0-1105.113
  • 5.4.0-1106.114
  • 5.4.0-1107.115
  • 5.4.0-1108.116
  • 5.4.0-1109.118
  • 5.4.0-1110.119
  • 5.4.0-1111.120
  • 5.4.0-1112.121
  • 5.4.0-1113.123
  • 5.4.0-1114.124
  • 5.4.0-1116.126
  • 5.4.0-1117.127
  • 5.4.0-1118.128
  • 5.4.0-1119.129
  • 5.4.0-1120.130
  • 5.4.0-1121.131
  • 5.4.0-1122.132
  • 5.4.0-1123.133
  • 5.4.0-1124.134
  • 5.4.0-1125.135
  • 5.4.0-1126.136
  • 5.4.0-1127.137
  • 5.4.0-1128.138
  • 5.4.0-1129.139
  • 5.4.0-1130.140
  • 5.4.0-1131.141
  • 5.4.0-1132.142
  • 5.4.0-1133.143
  • 5.4.0-1134.144
  • 5.4.0-1135.145
  • 5.4.0-1136.146
  • 5.4.0-1137.147
  • 5.4.0-1139.149
  • 5.4.0-1140.150
  • 5.4.0-1142.152
  • 5.4.0-1144.154
  • 5.4.0-1145.155
Ubuntu 20.04 Azure Released
99 kernels
  • 5.4.0-1041.43
  • 5.4.0-1040.42
  • 5.4.0-1023.23
  • 5.4.0-1034.35
  • 5.4.0-1035.36
  • 5.4.0-1031.32
  • 5.4.0-1032.33
  • 5.4.0-1039.41
  • 5.4.0-1020.20
  • 5.4.0-1026.26
  • 5.4.0-1025.25
  • 5.4.0-1043.45
  • 5.4.0-1022.22
  • 5.4.0-1036.38
  • 5.4.0-1024.24
  • 5.4.0-1027.27
  • 5.4.0-1029.29
  • 5.4.0-1033.34
  • 5.4.0-1037.39
  • 5.4.0-1038.40
  • 5.4.0-1044.46
  • 5.4.0-1046.48
  • 5.4.0-1047.49
  • 5.4.0-1048.50
  • 5.4.0-1049.51
  • 5.4.0-1051.53
  • 5.4.0-1055.57
  • 5.4.0-1056.58
  • 5.4.0-1058.60
  • 5.4.0-1059.62
  • 5.4.0-1062.65
  • 5.4.0-1063.66
  • 5.4.0-1061.64
  • 5.4.0-1064.67
  • 5.4.0-1065.68
  • 5.4.0-1067.70
  • 5.4.0-1068.71
  • 5.4.0-1069.72
  • 5.4.0-1070.73
  • 5.4.0-1072.75
  • 5.4.0-1073.76
  • 5.4.0-1074.77
  • 5.4.0-1077.80
  • 5.4.0-1078.81
  • 5.4.0-1080.83
  • 5.4.0-1083.87
  • 5.4.0-1085.90
  • 5.4.0-1086.91
  • 5.4.0-1089.94
  • 5.4.0-1090.95
  • 5.4.0-1091.96
  • 5.4.0-1094.100
  • 5.4.0-1098.104
  • 5.4.0-1100.106
  • 5.4.0-1101.107
  • 5.4.0-1103.109
  • 5.4.0-1104.110
  • 5.4.0-1105.111
  • 5.4.0-1106.112
  • 5.4.0-1107.113
  • 5.4.0-1108.114
  • 5.4.0-1109.115
  • 5.4.0-1110.116
  • 5.4.0-1111.117
  • 5.4.0-1112.118
  • 5.4.0-1113.119
  • 5.4.0-1114.120
  • 5.4.0-1115.122
  • 5.4.0-1116.123
  • 5.4.0-1117.124
  • 5.4.0-1118.125
  • 5.4.0-1119.126
  • 5.4.0-1120.127
  • 5.4.0-1121.128
  • 5.4.0-1122.129
  • 5.4.0-1123.130
  • 5.4.0-1124.131
  • 5.4.0-1126.133
  • 5.4.0-1127.134
  • 5.4.0-1128.135
  • 5.4.0-1129.136
  • 5.4.0-1130.137
  • 5.4.0-1131.138
  • 5.4.0-1132.139
  • 5.4.0-1133.140
  • 5.4.0-1134.141
  • 5.4.0-1135.142
  • 5.4.0-1136.143
  • 5.4.0-1137.144
  • 5.4.0-1138.145
  • 5.4.0-1139.146
  • 5.4.0-1140.147
  • 5.4.0-1142.149
  • 5.4.0-1143.150
  • 5.4.0-1145.152
  • 5.4.0-1147.154
  • 5.4.0-1148.155
  • 5.4.0-1149.156
  • 5.4.0-1150.157
Ubuntu 20.04 GCP Ready For Release —
Ubuntu 22.04 Planned —
Ubuntu 22.04 AWS Planned —
Ubuntu 22.04 Azure Planned —