Description

In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time. [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0 [Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G OE 5.17.0-rc3+ #4 [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 [Thu Feb 10 12:59:06 2022] Call Trace: [Thu Feb 10 12:59:06 2022] <IRQ> [Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78 [Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0 [Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0 [Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0 [Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20 [Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140 [Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10 [Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b [Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150 [Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30 [Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0 ... [Thu Feb 10 12:59:07 2022] Freed by task 58179: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30 [Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40 [Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170 [Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20 [Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0 [Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae [Thu Feb 10 12:59:07 2022] Last potentially related work creation: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0 [Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10 [Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0 [Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  7.8 HIGH

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/147a0e71ccf96df9fc8c2ac500829d8e423ef02c	Patch
https://git.kernel.org/stable/c/2fe0e281f7ad0a62259649764228227dd6b2561d	Patch
https://git.kernel.org/stable/c/3d6cc9898efdfb062efb74dc18cfc700e082f5d5	Patch
https://git.kernel.org/stable/c/546d60859ecf13380fcabcbeace53a5971493a2b	Patch
https://git.kernel.org/stable/c/563431c1f3c8f2230e4a9c445fa23758742bc4f0	Patch
https://git.kernel.org/stable/c/da834d6c1147c7519a9e55b510a03b7055104749	Patch
https://git.kernel.org/stable/c/df9db1a2af37f39ad1653c7b9b0d275d72d0bc67	Patch
https://git.kernel.org/stable/c/e208668ef7ba23efcbf76a8200cab8deee501c4d	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-415	Double Free	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 8/27/2024 12:07:32 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 738 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.9.305 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 4.14.270 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.233 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.183 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up t
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-415
Changed	Reference Type	https://git.kernel.org/stable/c/147a0e71ccf96df9fc8c2ac500829d8e423ef02c No Types Assigned	https://git.kernel.org/stable/c/147a0e71ccf96df9fc8c2ac500829d8e423ef02c Patch
Changed	Reference Type	https://git.kernel.org/stable/c/2fe0e281f7ad0a62259649764228227dd6b2561d No Types Assigned	https://git.kernel.org/stable/c/2fe0e281f7ad0a62259649764228227dd6b2561d Patch
Changed	Reference Type	https://git.kernel.org/stable/c/3d6cc9898efdfb062efb74dc18cfc700e082f5d5 No Types Assigned	https://git.kernel.org/stable/c/3d6cc9898efdfb062efb74dc18cfc700e082f5d5 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/546d60859ecf13380fcabcbeace53a5971493a2b No Types Assigned	https://git.kernel.org/stable/c/546d60859ecf13380fcabcbeace53a5971493a2b Patch
Changed	Reference Type	https://git.kernel.org/stable/c/563431c1f3c8f2230e4a9c445fa23758742bc4f0 No Types Assigned	https://git.kernel.org/stable/c/563431c1f3c8f2230e4a9c445fa23758742bc4f0 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/da834d6c1147c7519a9e55b510a03b7055104749 No Types Assigned	https://git.kernel.org/stable/c/da834d6c1147c7519a9e55b510a03b7055104749 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/df9db1a2af37f39ad1653c7b9b0d275d72d0bc67 No Types Assigned	https://git.kernel.org/stable/c/df9db1a2af37f39ad1653c7b9b0d275d72d0bc67 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/e208668ef7ba23efcbf76a8200cab8deee501c4d No Types Assigned	https://git.kernel.org/stable/c/e208668ef7ba23efcbf76a8200cab8deee501c4d Patch

New CVE Received by NIST 8/21/2024 10:15:05 PM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 3554 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time. [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_deque
Added	Reference		kernel.org https://git.kernel.org/stable/c/147a0e71ccf96df9fc8c2ac500829d8e423ef02c [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/2fe0e281f7ad0a62259649764228227dd6b2561d [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/3d6cc9898efdfb062efb74dc18cfc700e082f5d5 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/546d60859ecf13380fcabcbeace53a5971493a2b [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/563431c1f3c8f2230e4a9c445fa23758742bc4f0 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/da834d6c1147c7519a9e55b510a03b7055104749 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/df9db1a2af37f39ad1653c7b9b0d275d72d0bc67 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/e208668ef7ba23efcbf76a8200cab8deee501c4d [No types assigned]