CVE-2023-52752

smb: client: fix use-after-free bug in cifs_debug_data_proc_show()

HIGH

7.8

CVSS Score

Published: May 21, 2024 at 03:30 PM UTC

Updated: August 5, 2026 at 10:24 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() Skip SMB sessions that are being teared down (e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show() to avoid use-after-free in @ses. This fixes the following GPF when reading from /proc/fs/cifs/DebugData while mounting and umounting [ 816.251274] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI ... [ 816.260138] Call Trace: [ 816.260329] <TASK> [ 816.260499] ? die_addr+0x36/0x90 [ 816.260762] ? exc_general_protection+0x1b3/0x410 [ 816.261126] ? asm_exc_general_protection+0x26/0x30 [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs] [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs] [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs] [ 816.262689] ? seq_read_iter+0x379/0x470 [ 816.262995] seq_read_iter+0x118/0x470 [ 816.263291] proc_reg_read_iter+0x53/0x90 [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f [ 816.263945] vfs_read+0x201/0x350 [ 816.264211] ksys_read+0x75/0x100 [ 816.264472] do_syscall_64+0x3f/0x90 [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 816.265135] RIP: 0033:0x7fd5e669d381

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

v ≥ 3.12.48v < 5.10.2373.12.48 ≤ v < 3.133.13 ≤ v < 5.10.2373.13 ≤ v < 5.15.1813.13 ≤ v < 6.1.643.13 ≤ v < 6.5.133.13 ≤ v < 6.6.33.13 ≤ v < 6.75.11 ≤ v < 5.15.1815.16 ≤ v < 6.1.646.2 ≤ v < 6.5.136.6 ≤ v < 6.6.31da177e4c3f43.12.48 3.137f48558e6489d032b1584b0cc9ac4bb11072c034a67172a013953664b1dad03c648200c70b90506c

Vendor states this is fixed in 0ab6f842452ce2cae04209d4671ac6289d0aef8a (fixed)

Vendor states this is fixed in 2abdf136784b7edaec7ffe0f4b461b63f9c4c4de (fixed)

Vendor states this is fixed in 336a066990bb3962c46daf574ace596bda9303ce (fixed)

Vendor states this is fixed in 558817597d5fbd7af31f891b67b0fd20f0d047b7 (fixed)

Vendor states this is fixed in 89929ea46f9cc11ba66d2c64713aa5d5dc723b09 (fixed)

Vendor states this is fixed in d328c09ee9f15ee5a26431f5aad7c9239fa85e62 (fixed)

Vendor states this is fixed in 3.13 (unaffected)

Vendor states this is fixed in 5.10.237 (unaffected)

Vendor states this is fixed in 5.15.181 (unaffected)

Vendor states this is fixed in 6.1.64 (unaffected)

Vendor states this is fixed in 6.5.13 (unaffected)

Vendor states this is fixed in 6.6.3 (unaffected)

Vendor states this is fixed in 6.7 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references