linux-kernel - Re: CVE-2023-52572: cifs: Fix UAF in cifs_demultiplex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 5 Mar 2024 11:08:09 +0000
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Robert Frohl <rfrohl@...e.com>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: CVE-2023-52572: cifs: Fix UAF in cifs_demultiplex_thread()

On Tue, Mar 05, 2024 at 11:38:49AM +0100, Robert Frohl wrote:
> Hi all,
> 
> this seems to be a duplicate of CVE-2023-1192 [0], even though NVD lists
> another, wrong patch. The RH bug has more details [1].
> 
> Cheers,
> Robert
> 
> 
> [0] https://nvd.nist.gov/vuln/detail/CVE-2023-1192
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=2154178#c28

That's a mess.  Please have RH update the json entry with CVE with the
correct git commit id and then I'll be glad to revoke this.  The
information in NVD is not "real" from the point of view of the CVE
database, so I can't take information there as being correct, or not.
As you know, NVD is just an add-on for CVE entries, one of many created
by many different groups/governments.

Until it's fixed in the CVE database, this CVE should stand as it refers
to the correct fix that people need to know about, not the incorrect one
in the RH-assigned CVE.

thanks,

greg k-h