Linux Kernel ksmbd Type Confusion Vulnerability via Race Condition in IPC Message Handling

A type confusion vulnerability has been identified in the Linux kernel's ksmbd component. This issue arises from a race condition in the handling of IPC messages, specifically when the ipc_msg_send_request's handle is allocated using ksmbd_acquire_id. The vulnerability allows req->handle from ksmbd_ipc_login_request and the FSCTL_PIPE_TRANSCEIVE ioctl to overlap, leading to confusion between messages. As a result, this could permit access to unintended areas of memory following an incorrect message delivery. While ksmbd verifies the type of IPC responses, it fails to properly manage the continuation to the next response, leaving a gap in the handling process.

Impact

Exploitation of this vulnerability could result in unauthorized access to memory, potentially leading to information disclosure or manipulation.