CVE-2023-52480
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | |…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race condition between ksmbd_session_lookup and ksmbd_expire_session.
- CVSS 3.1
- 7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666bePatch
- https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745fPatch
- https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202bPatch
- https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066fPatch
- https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666bePatch
- https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745fPatch
- https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202bPatch
- https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066fPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.