{ "schema_version": "1.6.1", "id": "RPI-CVE-2023-52480", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2023-52480" ], "published": "2024-02-29T05:43:35Z", "summary": "ksmbd: fix race condition between session lookup and expire", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix race condition between session lookup and expire\n\n Thread A + Thread B\n ksmbd_session_lookup | smb2_sess_setup\n sess = xa_load |\n |\n | xa_erase(&conn->sessions, sess->id);\n |\n | ksmbd_session_destroy(sess) --> kfree(sess)\n |\n // UAF! |\n sess->last_active = jiffies |\n +\n\nThis patch add rwsem to fix race condition between ksmbd_session_lookup\nand ksmbd_expire_session.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt2", "1:6.1.47-1+rpt4", "1:6.1.54-1+rpt2" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi2-rpi-v6", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7l", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v8", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-2712", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v6", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v7", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v7l", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v8", "binary_version": "1:6.1.54-1+rpt2" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt2": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.57" }, "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.57", "compiled_filter": false }, "1:6.1.54-1+rpt2": { "linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7", "upstream_version": "6.1.54", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.57" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2023-52480" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-15T12:24:41Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 9.8, "cvss_v3_severity": "Critical", "scenario": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the UAF is reached by processing remotely supplied SMB2 SESSION_SETUP and concurrent session-bearing PDUs in ksmbd worker threads, with no local access required.\nAC:L - The attacker controls both sides of the race by sending concurrent requests on the same connection\u2014one path calls unlocked ksmbd_session_lookup while another SESSION_SETUP(SessionId=0) runs ksmbd_session_register\u2192ksmbd_expire_session\u2192kfree\u2014and can retry freely via the ksmbd-io workqueue.\nPR:N - SESSION_SETUP with SessionId=0 creates an SMB2_SESSION_IN_PROGRESS session before any credential check, and expire destroys any non-VALID session; smb2_check_user_session still enters ksmbd_session_lookup and performs the UAF write before the VALID-state filter, so no authentication is required.\nUI:N - Exploitation is driven entirely by the remote attacker\u2019s SMB traffic to ksmbd; no local user or administrator action is needed beyond ksmbd already listening.\nS:U - This is a standard in-kernel use-after-free within the host kernel\u2019s security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The race is a use-after-free on struct ksmbd_session; reclaiming the freed object (including forging state==VALID so lookup_all returns a dangling sess) yields a kernel read primitive over session keys, pointers, and adjacent heap.\nI:H - ksmbd_session_lookup performs a write of jiffies into freed session memory, and a reclaimed fake session is then consumed by later SMB command handling\u2014an exploitable UAF write/control-flow hijack primitive in ring 0.\nA:H - Even without full exploitation, the UAF read/write on a kfree\u2019d session crashes ksmbd worker threads (KASAN slab-UAF / oops/panic), and an unauthenticated attacker can retrigger the race indefinitely." } } }