cifs: prevent use-after-free by freeing the cfile later (CVE-2023-53377)

Summary

cifs: prevent use-after-free by freeing the cfile later

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

cifs: prevent use-after-free by freeing the cfile later

In smb2_compound_op we have a possible use-after-free
which can cause hard to debug problems later on.

This was revealed during stress testing with KASAN enabled
kernel. Fixing it by moving the cfile free call to
a few lines below, after the usage.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.3.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.4"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-53377 linux Fixed in: 6.1.52-1

Summary

Original description

Affected packages

Fix status by distribution

References