title: ksmbd: fix race condition between session lookup and expire
description: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix race condition between session lookup and expire
Thread A                        +  Thread B
ksmbd_session_lookup            |  smb2_sess_setup
sess = xa_load                |
|
|    xa_erase(&conn->sessions, sess->id);
|
|    ksmbd_session_destroy(sess) --> kfree(sess)
|
// UAF!                       |
sess->last_active = jiffies   |
+
This patch add rwsem to fix race condition between ksmbd_session_lookup
and ksmbd_expire_session.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 1da177e4c3f4, lessThan: c77fd3e25a51, status: affected, versionType: git
version: 1da177e4c3f4, lessThan: a2ca5fd3dbcc, status: affected, versionType: git
version: 1da177e4c3f4, lessThan: 18ced78b0ebc, status: affected, versionType: git
version: 1da177e4c3f4, lessThan: 53ff5cf89142, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.15.145, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.57, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.7, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
