CVE-2024-35870

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF in smb2_reconnect_server()

The UAF bug is due to smb2_reconnect_server() accessing a session that

is already being teared down by another thread that is executing

__cifs_put_smb_ses(). This can happen when (a) the client has

connection to the server but no session or (b) another thread ends up

setting @ses->ses_status again to something different than

SES_EXITING.

To fix this, we need to make sure to unconditionally set

@ses->ses_status to SES_EXITING and prevent any other threads from

setting a new status while we're still tearing it down.

The following can be reproduced by adding some delay to right after

the ipc is freed in __cifs_put_smb_ses() - which will give

smb2_reconnect_server() worker a chance to run and then accessing

@ses->ipc:

kinit ...

mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10

[disconnect srv]

ls /mnt/1 &>/dev/null

sleep 30

kdestroy

[reconnect srv]

sleep 10

umount /mnt/1

...

CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed

CIFS: VFS: \\srv Send error in SessSetup = -126

CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed

CIFS: VFS: \\srv Send error in SessSetup = -126

general protection fault, probably for non-canonical address

0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI

CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39

04/01/2014

Workqueue: cifsiod smb2_reconnect_server [cifs]

RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0

Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad

de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75

7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8

RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83

RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b

RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800

RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000

R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000

FS: 0000000000000000(0000) GS:ffff888157c00000(0000)

knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0

PKRU: 55555554

Call Trace:

<TASK>

? die_addr+0x36/0x90

? exc_general_protection+0x1c1/0x3f0

? asm_exc_general_protection+0x26/0x30

? __list_del_entry_valid_or_report+0x33/0xf0

__cifs_put_smb_ses+0x1ae/0x500 [cifs]

smb2_reconnect_server+0x4ed/0x710 [cifs]

process_one_work+0x205/0x6b0

worker_thread+0x191/0x360

? __pfx_worker_thread+0x10/0x10

kthread+0xe2/0x110

? __pfx_kthread+0x10/0x10

ret_from_fork+0x34/0x50

? __pfx_kthread+0x10/0x10

ret_from_fork_asm+0x1a/0x30

</TASK>