linux-kernel - Fwd: [PATCH v2] cifs: fix use-after-free on the link name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAH2r5msCeS_3LJffON76hOO5fe7HA6Kc-5z7wDbXuoEDAijVbA@mail.gmail.com>
Date:   Fri, 4 Nov 2022 23:39:08 -0500
From:   Steve French <smfrench@...il.com>
To:     CIFS <linux-cifs@...r.kernel.org>,
        samba-technical <samba-technical@...ts.samba.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Fwd: [PATCH v2] cifs: fix use-after-free on the link name

tentatively merged into cifs-2.6.git for-next pending additional testing

On Fri, Nov 4, 2022 at 12:57 PM Paulo Alcantara via samba-technical
<samba-technical@...ts.samba.org> wrote:
>
> ChenXiaoSong <chenxiaosong2@...wei.com> writes:
>
> > When opened a symlink, link name is from 'inode->i_link', but it may be
> > reset to a new value when revalidate the dentry. If some processes get the
> > link name on the race scenario, then UAF will happen on link name.
> >
> > Fix this by implementing 'get_link' interface to duplicate the link name.
> >
> > Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
> > Signed-off-by: ChenXiaoSong <chenxiaosong2@...wei.com>
> > ---
> >  fs/cifs/cifsfs.c | 26 +++++++++++++++++++++++++-
> >  fs/cifs/inode.c  |  5 -----
> >  2 files changed, 25 insertions(+), 6 deletions(-)
>
> Reviewed-by: Paulo Alcantara (SUSE) <pc@....nz>
>


-- 
Thanks,

Steve


-- 
Thanks,

Steve