linux-cve-announce - CVE-2023-53597: cifs: fix mid leak during reconnection after timeout threshold

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100429-CVE-2023-53597-e30c@gregkh>
Date: Sat,  4 Oct 2025 17:51:51 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53597: cifs: fix mid leak during reconnection after timeout threshold

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix mid leak during reconnection after timeout threshold

When the number of responses with status of STATUS_IO_TIMEOUT
exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect
the connection. But we do not return the mid, or the credits
returned for the mid, or reduce the number of in-flight requests.

This bug could result in the server->in_flight count to go bad,
and also cause a leak in the mids.

This change moves the check to a few lines below where the
response is decrypted, even of the response is read from the
transform header. This way, the code for returning the mids
can be reused.

Also, the cifs_reconnect was reconnecting just the transport
connection before. In case of multi-channel, this may not be
what we want to do after several timeouts. Changed that to
reconnect the session and the tree too.

Also renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name
MAX_STATUS_IO_TIMEOUT.

The Linux kernel CVE team has assigned CVE-2023-53597 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.10 with commit 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 and fixed in 5.15.150 with commit df31d05f0678cdd0796ea19983a2b93edca18bb0
	Issue introduced in 5.10 with commit 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 and fixed in 6.1.42 with commit c55901d381a22300c9922170e59704059f50977b
	Issue introduced in 5.10 with commit 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 and fixed in 6.4.7 with commit 57d25e9905c71133e201f6d06b56a3403d4ad433
	Issue introduced in 5.10 with commit 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 and fixed in 6.5 with commit 69cba9d3c1284e0838ae408830a02c4a063104bc
	Issue introduced in 5.9.5 with commit fa6d7a5853f93efb088aba36af12cb1944156411

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53597
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/smb/client/connect.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/df31d05f0678cdd0796ea19983a2b93edca18bb0
	https://git.kernel.org/stable/c/c55901d381a22300c9922170e59704059f50977b
	https://git.kernel.org/stable/c/57d25e9905c71133e201f6d06b56a3403d4ad433
	https://git.kernel.org/stable/c/69cba9d3c1284e0838ae408830a02c4a063104bc