In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same
persistent_id race the fp->owner.name compare-read in
ksmbd_vfs_compare_durable_owner() against the kfree() in
ksmbd_reopen_durable_fd()'s reopen-success path. fp->owner.name is a
standalone kstrdup() buffer whose lifetime is independent of the fp
refcount, and the two sites share no lock: the compare reads the buffer
while the reopen frees it, so the strcmp() can dereference freed memory.
Commit 7ce4fc40018d ("ksmbd: fix durable reconnect double-bind race in
ksmbd_reopen_durable_fd") made the fp->conn claim atomic under
global_ft.lock (closing the owner.name double-free and the ksmbd_file
write-UAF), but the compare-read versus reopen-free pair was left
unserialized.
BUG: KASAN: slab-use-after-free in strcmp+0x2c/0x80
Read of size 1 by task kworker
strcmp
ksmbd_vfs_compare_durable_owner
smb2_check_durable_oplock
smb2_open
Freed by task kworker:
kfree
ksmbd_reopen_durable_fd
smb2_open
Allocated by task kworker:
kstrdup
session_fd_check
smb2_session_logoff
The buggy address belongs to the cache kmalloc-8
Serialize both sides of the race with fp->f_lock. The global durable
file-table lock still protects the durable reconnect claim, but
fp->owner.name is per-open state and does not need to block unrelated
durable table lookups or reconnects. The teardown is left at its
existing location after the reopen-success point so that an __open_id()
rollback still retains owner.name for a later legitimate reconnect to
verify.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The flaw is reached via ksmbd's in-kernel SMB2 server on TCP port 445; remote SMB2_CREATE durable-handle reconnect packets (DH2C/DHnC) traverse ksmbd_conn_handler_loop() -> smb2_check_user_session() -> smb2_open() -> parse_durable_handle_context() -> smb2_check_durable_oplock() / ksmbd_reopen_durable_fd().
AC:L - The attacker controls both sides of the race by opening a durable handle, issuing SMB2_LOGOFF to preserve owner.name via session_fd_check(), then sending concurrent SMB2_CREATE durable reconnect requests for the same persistent_id from multiple connections; no timing or layout outside attacker control is required.
PR:N - Exploitation requires only network reachability to ksmbd and valid SMB session credentials (guest or any share user) plus tree connect; no elevated host privileges, capabilities, or local access are needed beyond share-level SMB access obtainable through the protocol itself.
UI:N - No victim user interaction is required beyond a server running ksmbd with durable handles enabled; the attacker programmatically drives the open, logoff, and concurrent reconnect SMB2 sequence over the network.
S:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same host security authority; this is not a VM escape, container boundary bypass, or IOMMU/DMA isolation break.
C:H - strcmp() in ksmbd_vfs_compare_durable_owner() dereferences a freed kmalloc-8 fp->owner.name buffer while a concurrent ksmbd_reopen_durable_fd() kfree() runs; this slab use-after-free enables arbitrary kernel memory disclosure via heap reuse.
I:H - Use-after-free of the standalone owner.name kstrdup buffer provides kernel heap corruption primitives; with heap grooming the freed slab can be reallocated for arbitrary kernel memory writes and control-flow hijacking.
A:H - KASAN reports slab-use-after-free in strcmp on the owner.name buffer during concurrent smb2_open durable reconnects; the UAF can trigger kernel oops or panic on ksmbd worker threads and is repeatable by resending concurrent reconnect requests.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is reached via ksmbd's in-kernel SMB2 server on TCP port 445; remote SMB2_CREATE durable-handle reconnect packets (DH2C/DHnC) traverse ksmbd_conn_handler_loop() -> smb2_check_user_session() -> smb2_open() -> parse_durable_handle_context() -> smb2_check_durable_oplock() / ksmbd_reopen_durable_fd().
AC:L - The attacker controls both sides of the race by opening a durable handle, issuing SMB2_LOGOFF to preserve owner.name via session_fd_check(), then sending concurrent SMB2_CREATE durable reconnect requests for the same persistent_id from multiple connections; no timing or layout outside attacker control is required.
PR:N - Exploitation requires only network reachability to ksmbd and valid SMB session credentials (guest or any share user) plus tree connect; no elevated host privileges, capabilities, or local access are needed beyond share-level SMB access obtainable through the protocol itself.
UI:N - No victim user interaction is required beyond a server running ksmbd with durable handles enabled; the attacker programmatically drives the open, logoff, and concurrent reconnect SMB2 sequence over the network.
S:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same host security authority; this is not a VM escape, container boundary bypass, or IOMMU/DMA isolation break.
C:H - strcmp() in ksmbd_vfs_compare_durable_owner() dereferences a freed kmalloc-8 fp->owner.name buffer while a concurrent ksmbd_reopen_durable_fd() kfree() runs; this slab use-after-free enables arbitrary kernel memory disclosure via heap reuse.
I:H - Use-after-free of the standalone owner.name kstrdup buffer provides kernel heap corruption primitives; with heap grooming the freed slab can be reallocated for arbitrary kernel memory writes and control-flow hijacking.
A:H - KASAN reports slab-use-after-free in strcmp on the owner.name buffer during concurrent smb2_open durable reconnects; the UAF can trigger kernel oops or panic on ksmbd worker threads and is repeatable by resending concurrent reconnect requests.
CVSS 3.1