ksmbd: fix race condition between session lookup and expire
Summary
| CVE | CVE-2023-52480 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-02-29 06:15:46 UTC |
| Updated | 2026-08-15 13:17:43 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race condition between ksmbd_session_lookup and ksmbd_expire_session. |
Risk And Classification
Primary CVSS: v3.1 7 HIGH from [email protected]
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-362
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected a6a9601ba995d0fec635324cb9fd8d14f9bea14e c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f git | Not specified |
| CNA | Linux | Linux | affected 1fc8a2b14ef5223f8e0b95faba2ee0a6e4d0f99d a2ca5fd3dbcc665e1169044fa0c9e3eba779202b git | Not specified |
| CNA | Linux | Linux | affected ea174a91893956450510945a0c5d1a10b5323656 18ced78b0ebccc2d16f426143dc56ab3aad666be git | Not specified |
| CNA | Linux | Linux | affected ea174a91893956450510945a0c5d1a10b5323656 53ff5cf89142b978b1a5ca8dc4d4425e6a09745f git | Not specified |
| CNA | Linux | Linux | affected 750a2d772e9d9ff377fd32e3b6797bf2cd847a7a git | Not specified |
| CNA | Linux | Linux | affected 6775ee7ef4b37c521aa4cf3730f54554c4875542 git | Not specified |
| CNA | Linux | Linux | affected 6.1.29 6.1.57 semver | Not specified |
| CNA | Linux | Linux | affected 6.2.16 6.3 semver | Not specified |
| CNA | Linux | Linux | affected 6.3.2 6.4 semver | Not specified |
| CNA | Linux | Linux | affected 6.4 | Not specified |
| CNA | Linux | Linux | unaffected 6.4 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.57 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.5.7 6.5.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 200243 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6725-1)