CVE-2024-53179

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix use-after-free of signing key<br /> <br /> Customers have reported use-after-free in @ses-&gt;auth_key.response with<br /> SMB2.1 + sign mounts which occurs due to following race:<br /> <br /> task A task B<br /> cifs_mount()<br /> dfs_mount_share()<br /> get_session()<br /> cifs_mount_get_session() cifs_send_recv()<br /> cifs_get_smb_ses() compound_send_recv()<br /> cifs_setup_session() smb2_setup_request()<br /> kfree_sensitive() smb2_calc_signature()<br /> crypto_shash_setkey() *UAF*<br /> <br /> Fix this by ensuring that we have a valid @ses-&gt;auth_key.response by<br /> checking whether @ses-&gt;ses_status is SES_GOOD or SES_EXITING with<br /> @ses-&gt;ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF<br /> in smb2_reconnect_server()"), we made sure to call -&gt;logoff() only<br /> when @ses was known to be good (e.g. valid -&gt;auth_key.response), so<br /> it&amp;#39;s safe to access signing key when @ses-&gt;ses_status == SES_EXITING.