CVE-2024-35870

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF in smb2_reconnect_server()

The UAF bug is due to smb2_reconnect_server() accessing a session that

is already being teared down by another thread that is executing

__cifs_put_smb_ses(). This can happen when (a) the client has

connection to the server but no session or (b) another thread ends up

setting @ses->ses_status again to something different than

SES_EXITING.

To fix this, we need to make sure to unconditionally set

@ses->ses_status to SES_EXITING and prevent any other threads from

setting a new status while we're still tearing it down.

The following can be reproduced by adding some delay to right after

the ipc is freed in __cifs_put_smb_ses() - which will give

smb2_reconnect_server() worker a chance to run and then accessing

@ses->ipc:

kinit ...

mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10

[disconnect srv]

ls /mnt/1 &>/dev/null

sleep 30

kdestroy

[reconnect srv

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References