In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear ce->tgthint in free_tgts()
When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.
If ce->tgthint is not reset before it is used later, it results
in a use-after-free.
Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The dangling ce->tgthint is created while handling FSCTL_DFS_GET_REFERRALS/TRANS2_GET_DFS_REFERRAL replies from a remote SMB server over TCP/445 (smb2_get_dfs_refer → cache_refresh_path → update_cache_entry_locked → free_tgts). A malicious, compromised, or MITM'd DFS server reaches this purely over the network.
AC:L - A hostile DFS server controls referral TTL (down to CACHE_MIN_TTL), target lists, and TCP resets that drive dfs_cache_refresh and reconnect into update_cache_entry_locked; after free_tgts() the later get_tgt_name()/dfs_cache_noreq_update_tgthint() use is deterministic, and the attacker can size and retry referrals to leave the stale hint and reclaim the slab.
PR:N - The attacker is the remote SMB/DFS peer (or a MITM on an unsigned session) and needs no account, capability, or local privileges on the victim; the client authenticates to that server, and the kernel DFS cache parses the reply regardless of which local user owns the mount.
UI:N - Once a DFS CIFS mount exists (fstab, autofs/systemd automount, enterprise DFS, cifsroot), dfs_cache_refresh delayed work and reconnect-driven cifs_tree_connect()/dfs_cache_noreq_find() use the stale tgthint automatically after a server-induced refresh or TCP drop, with no further user action.
S:U - The use-after-free is of kmalloc'd cache_dfs_tgt objects in the client kernel heap and remains in the same host kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.
C:H - get_tgt_name() and dfs_cache_noreq_update_tgthint() dereference the freed cache_dfs_tgt (t->name). Reclaiming that slab with attacker-controlled SMB allocations yields an arbitrary kernel read via kstrdup/strcasecmp of a sprayed name pointer.
I:H - Use-after-free of the heap cache_dfs_tgt enables heap spraying and overlapping live objects; the dangling hint is also copied into DFS referral state and used for failover tree-connect, giving a write/control-flow primitive once the object is reclaimed.
A:H - Dereferencing the freed cache_dfs_tgt from reconnect (cifs_tree_connect → dfs_cache_noreq_find) or dfs_cache_find oopses or panics the client kernel, and a malicious server can retrigger it on every refresh or reconnect.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The dangling ce->tgthint is created while handling FSCTL_DFS_GET_REFERRALS/TRANS2_GET_DFS_REFERRAL replies from a remote SMB server over TCP/445 (smb2_get_dfs_refer → cache_refresh_path → update_cache_entry_locked → free_tgts). A malicious, compromised, or MITM'd DFS server reaches this purely over the network.
AC:L - A hostile DFS server controls referral TTL (down to CACHE_MIN_TTL), target lists, and TCP resets that drive dfs_cache_refresh and reconnect into update_cache_entry_locked; after free_tgts() the later get_tgt_name()/dfs_cache_noreq_update_tgthint() use is deterministic, and the attacker can size and retry referrals to leave the stale hint and reclaim the slab.
PR:N - The attacker is the remote SMB/DFS peer (or a MITM on an unsigned session) and needs no account, capability, or local privileges on the victim; the client authenticates to that server, and the kernel DFS cache parses the reply regardless of which local user owns the mount.
UI:N - Once a DFS CIFS mount exists (fstab, autofs/systemd automount, enterprise DFS, cifsroot), dfs_cache_refresh delayed work and reconnect-driven cifs_tree_connect()/dfs_cache_noreq_find() use the stale tgthint automatically after a server-induced refresh or TCP drop, with no further user action.
S:U - The use-after-free is of kmalloc'd cache_dfs_tgt objects in the client kernel heap and remains in the same host kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.
C:H - get_tgt_name() and dfs_cache_noreq_update_tgthint() dereference the freed cache_dfs_tgt (t->name). Reclaiming that slab with attacker-controlled SMB allocations yields an arbitrary kernel read via kstrdup/strcasecmp of a sprayed name pointer.
I:H - Use-after-free of the heap cache_dfs_tgt enables heap spraying and overlapping live objects; the dangling hint is also copied into DFS referral state and used for failover tree-connect, giving a write/control-flow primitive once the object is reclaimed.
A:H - Dereferencing the freed cache_dfs_tgt from reconnect (cifs_tree_connect → dfs_cache_noreq_find) or dfs_cache_find oopses or panics the client kernel, and a malicious server can retrigger it on every refresh or reconnect.
CVSS 3.1