Linux Kernel ksmbd Durable Reconnect Error Path File Lifetime Vulnerability

A vulnerability in the Linux kernel's ksmbd component can lead to a use-after-free error during durable reconnects in SMB2 file handling. After a successful reconnect, the same file object is republished into the session's volatile-id table. If an error occurs later in the smb2_open() process, the cleanup routine can inadvertently free the file object without removing the corresponding volatile-id entry from the session table. This issue arises because the file closure process is not aware of the session context, allowing the file object to be freed prematurely. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability can cause a use-after-free condition, potentially leading to memory corruption or exploitation opportunities.

Reproduction

To reproduce this vulnerability, initiate a durable reconnect in the ksmbd component of the Linux kernel. After the reconnect succeeds, the same file object is republished into the session's volatile-id table. Then, trigger an error in the smb2_open() process. The cleanup routine will first remove the session reference but will then call the durable put function, which frees the file object without removing the volatile-id entry from the session table, creating a use-after-free condition.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.