CVE-2023-52752

smb: client: fix use-after-free bug in cifs_debug_data_proc_show()

State: Published
Severity: 7.8 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free bug in cifs_debug_data_proc_show()

Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses.

This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting

[ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 2abdf136784b7edaec7ffe0f4b461b63f9c4c4deAffected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 336a066990bb3962c46daf574ace596bda9303ceAffected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 558817597d5fbd7af31f891b67b0fd20f0d047b7Affected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 89929ea46f9cc11ba66d2c64713aa5d5dc723b09Affected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 0ab6f842452ce2cae04209d4671ac6289d0aef8aAffected 7f48558e6489d032b1584b0cc9ac4bb11072c034 to before d328c09ee9f15ee5a26431f5aad7c9239fa85e62Affected a67172a013953664b1dad03c648200c70b90506cAffected 3.12.48 to before 3.13Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.64 through 6.1.Not affected 6.5.13 through 6.5.Not affected 6.6.3 through 6.6.*Not affected 6.7 and laterNot affected

Product

Versions

LinuxLinux

7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 2abdf136784b7edaec7ffe0f4b461b63f9c4c4deAffected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 336a066990bb3962c46daf574ace596bda9303ceAffected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 558817597d5fbd7af31f891b67b0fd20f0d047b7Affected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 89929ea46f9cc11ba66d2c64713aa5d5dc723b09Affected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before 0ab6f842452ce2cae04209d4671ac6289d0aef8aAffected
7f48558e6489d032b1584b0cc9ac4bb11072c034 to before d328c09ee9f15ee5a26431f5aad7c9239fa85e62Affected
a67172a013953664b1dad03c648200c70b90506cAffected
3.12.48 to before 3.13Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.64 through 6.1.*Not affected
6.5.13 through 6.5.*Not affected
6.6.3 through 6.6.*Not affected
6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.