Executive Summary

This vulnerability exists in the Linux kernel's ksmbd component, where a use-after-free error occurs due to improper memory management of the oplock_info structure.

Specifically, ksmbd frees the oplock_info structure immediately using kfree(), even though this structure is still accessed under RCU (Read-Copy-Update) read-side critical sections in functions like opinfo_get() and proc_show_files().

Because there is no RCU grace period delay between nullifying the pointer and freeing the memory, a reader can access the oplock_info structure after it has been freed, leading to a use-after-free condition.

This is particularly problematic in opinfo_get(), where atomic_inc_not_zero() is called on memory that may have already been freed.

The fix involves switching to deferred freeing of the oplock_info structure using call_rcu(), which ensures the memory is freed only after all readers have finished accessing it.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the ksmbd component uses call_rcu() for deferred freeing of oplock_info instead of immediate kfree().

Therefore, the immediate mitigation step is to apply the kernel update or patch that includes this fix.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel's ksmbd component. Specifically, oplock_info structures are freed immediately without waiting for an RCU grace period, which can cause readers to access memory that has already been freed. This can result in undefined behavior, potential crashes, or security issues due to accessing invalid memory.

Useful 0 Not Useful 0