278 lines
14 KiB
JSON
278 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-52480",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-02-20T12:30:33.300Z",
|
||
"datePublished": "2024-02-29T05:43:12.019Z",
|
||
"dateUpdated": "2026-08-15T12:23:49.816Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-15T12:23:49.816Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix race condition between session lookup and expire\n\n Thread A + Thread B\n ksmbd_session_lookup | smb2_sess_setup\n sess = xa_load |\n |\n | xa_erase(&conn->sessions, sess->id);\n |\n | ksmbd_session_destroy(sess) --> kfree(sess)\n |\n // UAF! |\n sess->last_active = jiffies |\n +\n\nThis patch add rwsem to fix race condition between ksmbd_session_lookup\nand ksmbd_expire_session."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 9.8,
|
||
"baseSeverity": "CRITICAL"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the UAF is reached by processing remotely supplied SMB2 SESSION_SETUP and concurrent session-bearing PDUs in ksmbd worker threads, with no local access required.\nAC:L - The attacker controls both sides of the race by sending concurrent requests on the same connection—one path calls unlocked ksmbd_session_lookup while another SESSION_SETUP(SessionId=0) runs ksmbd_session_register→ksmbd_expire_session→kfree—and can retry freely via the ksmbd-io workqueue.\nPR:N - SESSION_SETUP with SessionId=0 creates an SMB2_SESSION_IN_PROGRESS session before any credential check, and expire destroys any non-VALID session; smb2_check_user_session still enters ksmbd_session_lookup and performs the UAF write before the VALID-state filter, so no authentication is required.\nUI:N - Exploitation is driven entirely by the remote attacker’s SMB traffic to ksmbd; no local user or administrator action is needed beyond ksmbd already listening.\nS:U - This is a standard in-kernel use-after-free within the host kernel’s security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The race is a use-after-free on struct ksmbd_session; reclaiming the freed object (including forging state==VALID so lookup_all returns a dangling sess) yields a kernel read primitive over session keys, pointers, and adjacent heap.\nI:H - ksmbd_session_lookup performs a write of jiffies into freed session memory, and a reclaimed fake session is then consumed by later SMB command handling—an exploitable UAF write/control-flow hijack primitive in ring 0.\nA:H - Even without full exploitation, the UAF read/write on a kfree’d session crashes ksmbd worker threads (KASAN slab-UAF / oops/panic), and an unauthenticated attacker can retrigger the race indefinitely."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/smb/server/connection.c",
|
||
"fs/smb/server/connection.h",
|
||
"fs/smb/server/mgmt/user_session.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "a6a9601ba995d0fec635324cb9fd8d14f9bea14e",
|
||
"lessThan": "c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "1fc8a2b14ef5223f8e0b95faba2ee0a6e4d0f99d",
|
||
"lessThan": "a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "ea174a91893956450510945a0c5d1a10b5323656",
|
||
"lessThan": "18ced78b0ebccc2d16f426143dc56ab3aad666be",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "ea174a91893956450510945a0c5d1a10b5323656",
|
||
"lessThan": "53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "750a2d772e9d9ff377fd32e3b6797bf2cd847a7a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "6775ee7ef4b37c521aa4cf3730f54554c4875542",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "6.1.29",
|
||
"lessThan": "6.1.57",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.2.16",
|
||
"lessThan": "6.3",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.3.2",
|
||
"lessThan": "6.4",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/smb/server/connection.c",
|
||
"fs/smb/server/connection.h",
|
||
"fs/smb/server/mgmt/user_session.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "6.4",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "6.4",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.57",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.5.7",
|
||
"lessThanOrEqual": "6.5.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.1.29",
|
||
"versionEndExcluding": "6.1.57"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.4",
|
||
"versionEndExcluding": "6.5.7"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.4",
|
||
"versionEndExcluding": "6.6"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.2.16"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "6.3.2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f"
|
||
}
|
||
],
|
||
"title": "ksmbd: fix race condition between session lookup and expire",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T23:03:19.830Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2023-52480",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-09-10T15:57:23.856280Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-09-11T17:33:52.199Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |