Linux Kernel SMB2 Server Use-After-Free Vulnerability in Open Function

A use-after-free vulnerability has been fixed in the Linux kernel's SMB2 server implementation, specifically within the 'smb2_open' function. The issue arose because the 'opinfo' pointer, retrieved using 'rcu_dereference(fp->f_opinfo)', was dereferenced after releasing the RCU read lock, creating a window for potential exploitation.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, which may be exploited to cause memory corruption or execute arbitrary code.

Reproduction

The vulnerability can be reproduced by calling the 'smb2_open' function in the SMB server context. The 'opinfo' pointer will be incorrectly accessed after the RCU read lock is released, creating a use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.