In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
The race is between the handling of a new TCP connection and
its disconnection. It leads to UAF on struct tcp_transport
in
ksmbd_tcp_new_connection() function.
[
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"fs/smb/server/connection.c",
"fs/smb/server/connection.h",
"fs/smb/server/transport_rdma.c",
"fs/smb/server/transport_tcp.c"
],
"versions": [
{
"version": "a848c4f15ab6",
"lessThan": "999daf367b92",
"status": "affected",
"versionType": "git"
},
{
"version": "a848c4f15ab6",
"lessThan": "380965e48e9c",
"status": "affected",
"versionType": "git"
},
{
"version": "a848c4f15ab6",
"lessThan": "24290ba94cd0",
"status": "affected",
"versionType": "git"
},
{
"version": "a848c4f15ab6",
"lessThan": "69d54650b751",
"status": "affected",
"versionType": "git"
},
{
"version": "a848c4f15ab6",
"lessThan": "38d20c62903d",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"fs/smb/server/connection.c",
"fs/smb/server/connection.h",
"fs/smb/server/transport_rdma.c",
"fs/smb/server/transport_tcp.c"
],
"versions": [
{
"version": "5.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.15",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.15.149",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.1.75",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.6.14",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.7.2",
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.8",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
]
git.kernel.org/stable/c/24290ba94cd0136e417283b0dbf8fcdabcf62111
git.kernel.org/stable/c/380965e48e9c32ee4263c023e1d830ea7e462ed1
git.kernel.org/stable/c/38d20c62903d669693a1869aa68c4dd5674e2544
git.kernel.org/stable/c/69d54650b751532d1e1613a4fb433e591aeef126
git.kernel.org/stable/c/999daf367b924fdf14e9d83e034ee0f86bc17ec6