Received-SPF: pass (google.com: domain of linux-kernel+bounces-17902-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <1d2bb04665d19a4722a0b9f7f552cab3@manguebit.com>
From: Paulo Alcantara <pc@manguebit.com>
To: Salvatore Bonaccorso <carnil@debian.org>, Steve French
 <sfrench@samba.org>, Ronnie Sahlberg <lsahlber@redhat.com>, Shyam Prasad N
 <sprasad@microsoft.com>, Tom Talpey <tom@talpey.com>, Ben Hutchings
 <benh@debian.org>
Cc: linux-cifs@vger.kernel.org, samba-technical@lists.samba.org,
 linux-kernel@vger.kernel.org
Subject: Re: Information on use-after-free in smb2_is_status_io_timeout()?
In-Reply-To: <ZZgFEX3QNWWj_VxA@eldamar.lan>
References: <ZZgFEX3QNWWj_VxA@eldamar.lan>
Date: Fri, 05 Jan 2024 11:04:43 -0300
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain

Salvatore Bonaccorso <carnil@debian.org> writes:

> There is a Red Hat bugzilla report in
> https://bugzilla.redhat.com/show_bug.cgi?id=2154178 about a
> use-after-free in smb2_is_status_io_timeout() . While the commit noted
> initially there seems not correct, Ben Hutchings raised a question on
> more information in
> https://bugzilla.redhat.com/show_bug.cgi?id=2154178#c24 .
>
> (there is a CVE assigned for it, CVE-2023-1192)

That is supposed to be fixed by

        d527f51331ca ("cifs: Fix UAF in cifs_demultiplex_thread()")

While the commit refers to an UAF in ->is_network_name_deleted(), this
should also work for smb2_is_status_io_timeout(), AFAICT.