SB20240530172 - Use-after-free in Linux kernel smb client
Published: May 30, 2024 Updated: May 14, 2025
Security Bulletin ID
SB20240530172
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2023-52752)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the seq_printf() and spin_unlock() functions in fs/smb/client/cifs_debug.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/558817597d5fbd7af31f891b67b0fd20f0d047b7
- https://git.kernel.org/stable/c/89929ea46f9cc11ba66d2c64713aa5d5dc723b09
- https://git.kernel.org/stable/c/0ab6f842452ce2cae04209d4671ac6289d0aef8a
- https://git.kernel.org/stable/c/d328c09ee9f15ee5a26431f5aad7c9239fa85e62
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.237
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.181
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.64
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.13
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.3
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7