Received-SPF: pass (google.com: domain of linux-kernel+bounces-92827-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Tue, 5 Mar 2024 10:30:08 -0800 (PST)
From: Red Hat Product Security <secalert@redhat.com>
Reply-To: Red Hat Product Security <secalert@redhat.com>
To: security@suse.de, rfrohl@suse.de, cve@kernel.org,
	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org
Message-ID: <15436477.7601.1709663408600@app142018.ycg3.service-now.com>
Subject: Re: Re: CVE-2023-52572: cifs: Fix UAF in cifs_demultiplex_thread()
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_7599_6887775.1709663408599"
Precedence: bulk
Auto-Submitted: auto-generated

------=_Part_7599_6887775.1709663408599
Content-Type: multipart/alternative; 
	boundary="----=_Part_7600_23659363.1709663408600"

------=_Part_7600_23659363.1709663408600
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=UTF-8

Hello!

INC2885107 (Re: CVE-2023-52572: cifs: Fix UAF in cifs_demultiplex_thread()) has been updated.

Opened for: rfrohl@suse.de
Followers: cve@kernel.org, linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, security@suse.de

Rohit Keshri updated your request with the following comments:

Hello Robert,
 Thank you for reaching to Red Hat Product Security.
 I have reviewed the flaws, CVE-2023-1192 has the correct patch used in the reference.
 Also, CVE-2023-52572 is a duplicate of CVE-2023-1192, which we will soon request for the same.
 I will also share some observation for CVE-2023-1192 while it us under investigation:
~~~
## TL;DR
 After CIFS transfers response data to system call, there is still a local variable points to the memory region, and if system call frees it faster than CIFS uses it, CIFS will access a free memory region when calls function such as `smb2_is_status_io_timeout()` .
 ## Detail
 When client uses CIFS, system calls about file operation will call cifs API to send samba request, and there is a CIFS kernel thread handler `cifs_demultiplex_thread()` which receives response from remote server and transfer those data to corresponding syscall request.
 In the beginning, CIFS kernel thread will allocate memory chunk to `server->smallbuf` in function `allocate_buffers()` and assign the pointer to local variable `buf` . Then cifs kernel thread will get a `struct mid_q_entry` instance from `server->ops->find_mid()` , this struct is used to transfer data between kernel thread and system call. Then cifs kernel thread calls `standard_receive3()` to receive response from server, saving data into `server->smallbuf`, assigning `server->smallbuf` to `mid_q_entry` instance `mids[0]`, and marking this `mid_q_entry` has been received response finally.
~~~
 Please let us know if there are any further queries on this please.
 Regards,
Rohit

How can I track and update my request?

To respond, reply to this email. You may also create a new email and include the request number (INC2885107) in the subject.

Thank you,
Product Security

Ref:MSG86263708
------=_Part_7600_23659363.1709663408600
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8

<html><head></head><body><div><p style=3D"margin-top:0;margin-bottom:10px;"=
>Hello!</p><p style=3D"margin-top:0;margin-bottom:10px;">INC2885107 (Re: CV=
E-2023-52572: cifs: Fix UAF in cifs_demultiplex_thread()) has been updated.=
</p><p style=3D"margin-top:0;margin-bottom:10px;">Opened for:&nbsp;rfrohl@s=
use.de<br>Followers:&nbsp;cve@kernel.org, linux-kernel@vger.kernel.org, gre=
gkh@linuxfoundation.org, security@suse.de</p></div>
<p style=3D"margin-top: 10px; margin-bottom: 10px;">Rohit Keshri updated yo=
ur request with the following comments:</p>
<div style=3D"padding: 10px 0 10px 10px; background-color: ivory;"><div>Hel=
lo Robert,</div><div>&nbsp;</div><div>Thank you for reaching to Red Hat Pro=
duct Security.</div><div>&nbsp;</div><div>I have reviewed the flaws, CVE-20=
23-1192 has the correct patch used in the reference.</div><div>&nbsp;</div>=
<div>Also, CVE-2023-52572 is a duplicate of  CVE-2023-1192, which we will s=
oon request for the same.</div><div>&nbsp;</div><div>I will also share some=
 observation for CVE-2023-1192 while it us under investigation:</div><div>~=
~~</div><div>## TL;DR</div><div>&nbsp;</div><div>After CIFS transfers respo=
nse data to system call, there is still a local variable points to the memo=
ry region, and if system call frees it faster than CIFS uses it, CIFS will =
access a free memory region when calls function such as `smb2_is_status_io_=
timeout()` .</div><div>&nbsp;</div><div>## Detail</div><div>&nbsp;</div><di=
v>When client uses CIFS, system calls about file operation will call cifs A=
PI to send samba request, and there is a CIFS kernel thread handler `cifs_d=
emultiplex_thread()` which receives response from remote server and transfe=
r those data to corresponding syscall request.</div><div>&nbsp;</div><div>I=
n the beginning, CIFS kernel thread will allocate memory chunk to `server-&=
gt;smallbuf` in function `allocate_buffers()`  and assign the pointer to lo=
cal variable `buf` . Then cifs kernel thread will get a `struct mid_q_entry=
` instance from `server-&gt;ops-&gt;find_mid()` , this struct is used to tr=
ansfer data between kernel thread and system call. Then cifs kernel thread =
calls `standard_receive3()`  to receive response from server, saving data i=
nto `server-&gt;smallbuf`, assigning `server-&gt;smallbuf` to `mid_q_entry`=
 instance `mids[0]`, and marking this `mid_q_entry` has been received respo=
nse finally.</div><div>~~~</div><div>&nbsp;</div><div>Please let us know if=
 there are any further queries on this please.</div><div>&nbsp;</div><div>R=
egards,</div><div>Rohit</div></div>
<div><p style=3D"margin-top:20px;margin-bottom:10px;"><strong>How can I tra=
ck and update my request?</strong></p><p style=3D"margin-top:0;margin-botto=
m:10px;">To respond, reply to this email. You may also create a new email a=
nd include the request number (INC2885107) in the subject.</p></div>
<p style=3D"margin-top: 14px; margin-bottom: 0;">Thank you,<br>Product Secu=
rity</p><div>&nbsp;</div><div style=3D"display:inline">Ref:MSG86263708</div=
></body></html>
------=_Part_7600_23659363.1709663408600--

------=_Part_7599_6887775.1709663408599--