GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52741 (GCVE-0-2023-52741)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:23 – Updated: 2026-08-05 09:11
VLAI
Title
cifs: Fix use-after-free in rdata->read_into_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: <TASK> dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... # UAF in readpages_fill_pages() Similarly, this problem also occurs in the uncache_fill_pages(). Fix this by adjusts the order of condition judgment in the return statement.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-28 15:46 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e , < 2b693fe3f760c87fd9768e759f6297f743a1b3b0 (git)
Affected: b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e , < d1fba1e096ffc7ec11df863a97c50203c47315b9 (git)
Affected: b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e , < 3684a2f6affa1ca52a5d4a12f04d0652efdee65e (git)
Affected: b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e , < aa5465aeca3c66fecdf7efcf554aed79b4c4b211 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.17
Unaffected: 0 , < 3.17 (semver)
Unaffected: 5.10.168 , ≤ 5.10.* (semver)
Unaffected: 5.15.94 , ≤ 5.15.* (semver)
Unaffected: 6.1.12 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52741",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T15:46:03.268177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:24:17.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.667Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b693fe3f760c87fd9768e759f6297f743a1b3b0",
              "status": "affected",
              "version": "b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e",
              "versionType": "git"
            },
            {
              "lessThan": "d1fba1e096ffc7ec11df863a97c50203c47315b9",
              "status": "affected",
              "version": "b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e",
              "versionType": "git"
            },
            {
              "lessThan": "3684a2f6affa1ca52a5d4a12f04d0652efdee65e",
              "status": "affected",
              "version": "b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e",
              "versionType": "git"
            },
            {
              "lessThan": "aa5465aeca3c66fecdf7efcf554aed79b4c4b211",
              "status": "affected",
              "version": "b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.168",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.94",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.12",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata-\u003eread_into_pages()\n\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\n\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\n\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x38/0x4c\n   print_report+0x16f/0x4a6\n   kasan_report+0xb7/0x130\n   readpages_fill_pages+0x14c/0x7e0\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n   \u003c/TASK\u003e\n\n  Allocated by task 2535:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x82/0x90\n   cifs_readdata_direct_alloc+0x2c/0x110\n   cifs_readdata_alloc+0x2d/0x60\n   cifs_readahead+0x393/0xfe0\n   read_pages+0x12f/0x470\n   page_cache_ra_unbounded+0x1b1/0x240\n   filemap_get_pages+0x1c8/0x9a0\n   filemap_read+0x1c0/0x540\n   cifs_strict_readv+0x21b/0x240\n   vfs_read+0x395/0x4b0\n   ksys_read+0xb8/0x150\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n  Freed by task 79:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2e/0x50\n   __kasan_slab_free+0x10e/0x1a0\n   __kmem_cache_free+0x7a/0x1a0\n   cifs_readdata_release+0x49/0x60\n   process_one_work+0x46c/0x760\n   worker_thread+0x2a4/0x6f0\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\n  Last potentially related work creation:\n   kasan_save_stack+0x22/0x50\n   __kasan_record_aux_stack+0x95/0xb0\n   insert_work+0x2b/0x130\n   __queue_work+0x1fe/0x660\n   queue_work_on+0x4b/0x60\n   smb2_readv_callback+0x396/0x800\n   cifs_abort_connection+0x474/0x6a0\n   cifs_reconnect+0x5cb/0xa50\n   cifs_readv_from_socket.cold+0x22/0x6c\n   cifs_read_page_from_socket+0xc1/0x100\n   readpages_fill_pages.cold+0x2f/0x46\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\nThe following function calls will cause UAF of the rdata pointer.\n\nreadpages_fill_pages\n cifs_read_page_from_socket\n  cifs_readv_from_socket\n   cifs_reconnect\n    __cifs_reconnect\n     cifs_abort_connection\n      mid-\u003ecallback() --\u003e smb2_readv_callback\n       queue_work(\u0026rdata-\u003ework)  # if the worker completes first,\n                                 # the rdata is freed\n          cifs_readv_complete\n            kref_put\n              cifs_readdata_release\n                kfree(rdata)\n return rdata-\u003e...               # UAF in readpages_fill_pages()\n\nSimilarly, this problem also occurs in the uncache_fill_pages().\n\nFix this by adjusts the order of condition judgment in the return\nstatement."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is in the CIFS/SMB client\u0027s demultiplex path (cifs_demultiplex_thread \u2192 cifs_readv_receive \u2192 readpages_fill_pages) while consuming a remote SMB read response; a malicious or compromised file server (or on-path attacker) triggers reconnect by dropping/resetting TCP/445 mid-read, matching other cifs client reconnect UAFs scored AV:N.\nAC:L - The attacker fully controls when to abort the connection during an in-flight read and can refuse reconnect so __cifs_reconnect hits msleep(3000), giving the workqueue ample time to free rdata before the return accesses it; retries are unbounded.\nPR:N - The attacker is the remote SMB peer (or MITM) and needs no credentials or privileges on the victim client; abort/reconnect runs in the cifsd kernel thread from protocol/transport behavior alone.\nUI:N - Against an already-established CIFS mount (fstab, autofs, systemd automount, container share), normal client readahead/reads plus attacker-induced disconnects trigger the path with no victim action at exploit time.\nS:U - The freed cifs_readdata object and resulting heap corruption stay within the host kernel\u0027s security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of the heap-allocated rdata lets an attacker reclaim the slab and control the dangling rdata-\u003egot_bytes read (and related readdata state), yielding a kernel disclosure primitive per UAF guidance.\nI:H - The same UAF enables heap spraying/reclaim of cifs_readdata for write and control-flow hijack primitives, and a sprayed got_bytes can also divert post-reconnect mid handling into inconsistent success paths.\nA:H - The KASAN report shows a kernel use-after-free/oops in readpages_fill_pages on the freed rdata, so the bug denies availability even without further exploitation and is repeatedly triggerable by peer disconnects."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:10.506Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211"
        }
      ],
      "title": "cifs: Fix use-after-free in rdata-\u003eread_into_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52741",
    "datePublished": "2024-05-21T15:23:03.867Z",
    "dateReserved": "2024-05-21T15:19:24.233Z",
    "dateUpdated": "2026-08-05T09:11:10.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52741",
      "date": "2026-09-16",
      "epss": "0.00725",
      "percentile": "0.52357"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.10.168\", \"matchCriteriaId\": \"A4DAA7E9-6085-4834-B525-C3A82F7E6089\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.94\", \"matchCriteriaId\": \"55EC7465-CE9A-4B9C-B0FA-97394061A77F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.12\", \"matchCriteriaId\": \"63F0738E-F1B2-47A2-9329-E2B8BC87708A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF501633-2F44-4913-A8EE-B021929F49F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"A127C155-689C-4F67-B146-44A57F4BFD85\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"D34127CC-68F5-4703-A5F6-5006F803E4AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"C64BDD9D-C663-4E75-AE06-356EDC392B82\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: Fix use-after-free in rdata-\u003eread_into_pages()\\n\\nWhen the network status is unstable, use-after-free may occur when\\nread data from the server.\\n\\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\\n\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x38/0x4c\\n   print_report+0x16f/0x4a6\\n   kasan_report+0xb7/0x130\\n   readpages_fill_pages+0x14c/0x7e0\\n   cifs_readv_receive+0x46d/0xa40\\n   cifs_demultiplex_thread+0x121c/0x1490\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 2535:\\n   kasan_save_stack+0x22/0x50\\n   kasan_set_track+0x25/0x30\\n   __kasan_kmalloc+0x82/0x90\\n   cifs_readdata_direct_alloc+0x2c/0x110\\n   cifs_readdata_alloc+0x2d/0x60\\n   cifs_readahead+0x393/0xfe0\\n   read_pages+0x12f/0x470\\n   page_cache_ra_unbounded+0x1b1/0x240\\n   filemap_get_pages+0x1c8/0x9a0\\n   filemap_read+0x1c0/0x540\\n   cifs_strict_readv+0x21b/0x240\\n   vfs_read+0x395/0x4b0\\n   ksys_read+0xb8/0x150\\n   do_syscall_64+0x3f/0x90\\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n\\n  Freed by task 79:\\n   kasan_save_stack+0x22/0x50\\n   kasan_set_track+0x25/0x30\\n   kasan_save_free_info+0x2e/0x50\\n   __kasan_slab_free+0x10e/0x1a0\\n   __kmem_cache_free+0x7a/0x1a0\\n   cifs_readdata_release+0x49/0x60\\n   process_one_work+0x46c/0x760\\n   worker_thread+0x2a4/0x6f0\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n\\n  Last potentially related work creation:\\n   kasan_save_stack+0x22/0x50\\n   __kasan_record_aux_stack+0x95/0xb0\\n   insert_work+0x2b/0x130\\n   __queue_work+0x1fe/0x660\\n   queue_work_on+0x4b/0x60\\n   smb2_readv_callback+0x396/0x800\\n   cifs_abort_connection+0x474/0x6a0\\n   cifs_reconnect+0x5cb/0xa50\\n   cifs_readv_from_socket.cold+0x22/0x6c\\n   cifs_read_page_from_socket+0xc1/0x100\\n   readpages_fill_pages.cold+0x2f/0x46\\n   cifs_readv_receive+0x46d/0xa40\\n   cifs_demultiplex_thread+0x121c/0x1490\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n\\nThe following function calls will cause UAF of the rdata pointer.\\n\\nreadpages_fill_pages\\n cifs_read_page_from_socket\\n  cifs_readv_from_socket\\n   cifs_reconnect\\n    __cifs_reconnect\\n     cifs_abort_connection\\n      mid-\u003ecallback() --\u003e smb2_readv_callback\\n       queue_work(\u0026rdata-\u003ework)  # if the worker completes first,\\n                                 # the rdata is freed\\n          cifs_readv_complete\\n            kref_put\\n              cifs_readdata_release\\n                kfree(rdata)\\n return rdata-\u003e...               # UAF in readpages_fill_pages()\\n\\nSimilarly, this problem also occurs in the uncache_fill_pages().\\n\\nFix this by adjusts the order of condition judgment in the return\\nstatement.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: corrige el use after free en rdata-\u0026gt;read_into_pages(). Cuando el estado de la red es inestable, puede ocurrir el use after free al leer datos del servidor. BUG: KASAN: use after free en readpages_fill_pages+0x14c/0x7e0 Seguimiento de llamadas:  dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x 46d/0xa40 cifs_demultiplex_thread+0x121c/ 0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50  Asignado por tarea 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c /0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0 x150 do_syscall_64+0x3f/0x90 Entry_SYSCALL_64_after_hwframe+0x72/0xdc Liberado por la tarea 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 Process_one_work+0x46c /0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 \\u00daltima creaci\\u00f3n de trabajo potencialmente relacionado: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 ion+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+ 0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 x2c/0x50 Las siguientes llamadas a funciones causar\\u00e1n UAF del puntero rdata. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid-\u0026gt;callback() --\u0026gt; smb2_readv_callback queue_work(\u0026amp;rdata-\u0026gt;work) # si el trabajador completa primero, # los rdata se liberan cifs_readv_complete kref_put cifs_readdata_release kfree( rdata) devolver rdata-\u0026gt;... # UAF en readpages_fill_pages() De manera similar, este problema tambi\\u00e9n ocurre en uncache_fill_pages(). Solucione este problema ajustando el orden del juicio de condici\\u00f3n en la declaraci\\u00f3n de devoluci\\u00f3n.\"}]",
      "id": "CVE-2023-52741",
      "lastModified": "2025-01-06T20:40:21.543",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-21T16:15:14.000",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52741\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:14.000\",\"lastModified\":\"2026-08-04T10:18:39.273\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: Fix use-after-free in rdata-\u003eread_into_pages()\\n\\nWhen the network status is unstable, use-after-free may occur when\\nread data from the server.\\n\\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\\n\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x38/0x4c\\n   print_report+0x16f/0x4a6\\n   kasan_report+0xb7/0x130\\n   readpages_fill_pages+0x14c/0x7e0\\n   cifs_readv_receive+0x46d/0xa40\\n   cifs_demultiplex_thread+0x121c/0x1490\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 2535:\\n   kasan_save_stack+0x22/0x50\\n   kasan_set_track+0x25/0x30\\n   __kasan_kmalloc+0x82/0x90\\n   cifs_readdata_direct_alloc+0x2c/0x110\\n   cifs_readdata_alloc+0x2d/0x60\\n   cifs_readahead+0x393/0xfe0\\n   read_pages+0x12f/0x470\\n   page_cache_ra_unbounded+0x1b1/0x240\\n   filemap_get_pages+0x1c8/0x9a0\\n   filemap_read+0x1c0/0x540\\n   cifs_strict_readv+0x21b/0x240\\n   vfs_read+0x395/0x4b0\\n   ksys_read+0xb8/0x150\\n   do_syscall_64+0x3f/0x90\\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n\\n  Freed by task 79:\\n   kasan_save_stack+0x22/0x50\\n   kasan_set_track+0x25/0x30\\n   kasan_save_free_info+0x2e/0x50\\n   __kasan_slab_free+0x10e/0x1a0\\n   __kmem_cache_free+0x7a/0x1a0\\n   cifs_readdata_release+0x49/0x60\\n   process_one_work+0x46c/0x760\\n   worker_thread+0x2a4/0x6f0\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n\\n  Last potentially related work creation:\\n   kasan_save_stack+0x22/0x50\\n   __kasan_record_aux_stack+0x95/0xb0\\n   insert_work+0x2b/0x130\\n   __queue_work+0x1fe/0x660\\n   queue_work_on+0x4b/0x60\\n   smb2_readv_callback+0x396/0x800\\n   cifs_abort_connection+0x474/0x6a0\\n   cifs_reconnect+0x5cb/0xa50\\n   cifs_readv_from_socket.cold+0x22/0x6c\\n   cifs_read_page_from_socket+0xc1/0x100\\n   readpages_fill_pages.cold+0x2f/0x46\\n   cifs_readv_receive+0x46d/0xa40\\n   cifs_demultiplex_thread+0x121c/0x1490\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n\\nThe following function calls will cause UAF of the rdata pointer.\\n\\nreadpages_fill_pages\\n cifs_read_page_from_socket\\n  cifs_readv_from_socket\\n   cifs_reconnect\\n    __cifs_reconnect\\n     cifs_abort_connection\\n      mid-\u003ecallback() --\u003e smb2_readv_callback\\n       queue_work(\u0026rdata-\u003ework)  # if the worker completes first,\\n                                 # the rdata is freed\\n          cifs_readv_complete\\n            kref_put\\n              cifs_readdata_release\\n                kfree(rdata)\\n return rdata-\u003e...               # UAF in readpages_fill_pages()\\n\\nSimilarly, this problem also occurs in the uncache_fill_pages().\\n\\nFix this by adjusts the order of condition judgment in the return\\nstatement.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: corrige el use after free en rdata-\u0026gt;read_into_pages(). Cuando el estado de la red es inestable, puede ocurrir el use after free al leer datos del servidor. BUG: KASAN: use after free en readpages_fill_pages+0x14c/0x7e0 Seguimiento de llamadas:  dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x 46d/0xa40 cifs_demultiplex_thread+0x121c/ 0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50  Asignado por tarea 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c /0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0 x150 do_syscall_64+0x3f/0x90 Entry_SYSCALL_64_after_hwframe+0x72/0xdc Liberado por la tarea 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 Process_one_work+0x46c /0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 \u00daltima creaci\u00f3n de trabajo potencialmente relacionado: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 ion+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+ 0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 x2c/0x50 Las siguientes llamadas a funciones causar\u00e1n UAF del puntero rdata. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid-\u0026gt;callback() --\u0026gt; smb2_readv_callback queue_work(\u0026amp;rdata-\u0026gt;work) # si el trabajador completa primero, # los rdata se liberan cifs_readv_complete kref_put cifs_readdata_release kfree( rdata) devolver rdata-\u0026gt;... # UAF en readpages_fill_pages() De manera similar, este problema tambi\u00e9n ocurre en uncache_fill_pages(). Solucione este problema ajustando el orden del juicio de condici\u00f3n en la declaraci\u00f3n de devoluci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cifs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\",\"lessThan\":\"2b693fe3f760c87fd9768e759f6297f743a1b3b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\",\"lessThan\":\"d1fba1e096ffc7ec11df863a97c50203c47315b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\",\"lessThan\":\"3684a2f6affa1ca52a5d4a12f04d0652efdee65e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\",\"lessThan\":\"aa5465aeca3c66fecdf7efcf554aed79b4c4b211\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cifs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.168\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.94\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.12\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-28T15:46:03.268177Z\",\"id\":\"CVE-2023-52741\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.168\",\"matchCriteriaId\":\"A4DAA7E9-6085-4834-B525-C3A82F7E6089\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.94\",\"matchCriteriaId\":\"55EC7465-CE9A-4B9C-B0FA-97394061A77F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.12\",\"matchCriteriaId\":\"63F0738E-F1B2-47A2-9329-E2B8BC87708A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D34127CC-68F5-4703-A5F6-5006F803E4AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C64BDD9D-C663-4E75-AE06-356EDC392B82\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:26:03+00:00",
      "cve": "CVE-2023-52741",
      "id": "CVE-2023-52741",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: Fix use-after-free in rdata-\u0026gt;read_into_pages()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52741.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:24:34Z",
      "cve": "CVE-2023-52741",
      "id": "CVE-2023-52741",
      "initial_release_date": "2024-05-28T15:01:23Z",
      "product_status:known_affected": "421",
      "product_status:known_not_affected": "71",
      "product_status:recommended": "536",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52741",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52741.json",
      "version": "65"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:35.667Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52741\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-28T15:46:03.268177Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-28T15:46:07.421Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"cifs: Fix use-after-free in rdata-\u003eread_into_pages()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The UAF is in the CIFS/SMB client\u0027s demultiplex path (cifs_demultiplex_thread \\u2192 cifs_readv_receive \\u2192 readpages_fill_pages) while consuming a remote SMB read response; a malicious or compromised file server (or on-path attacker) triggers reconnect by dropping/resetting TCP/445 mid-read, matching other cifs client reconnect UAFs scored AV:N.\\nAC:L - The attacker fully controls when to abort the connection during an in-flight read and can refuse reconnect so __cifs_reconnect hits msleep(3000), giving the workqueue ample time to free rdata before the return accesses it; retries are unbounded.\\nPR:N - The attacker is the remote SMB peer (or MITM) and needs no credentials or privileges on the victim client; abort/reconnect runs in the cifsd kernel thread from protocol/transport behavior alone.\\nUI:N - Against an already-established CIFS mount (fstab, autofs, systemd automount, container share), normal client readahead/reads plus attacker-induced disconnects trigger the path with no victim action at exploit time.\\nS:U - The freed cifs_readdata object and resulting heap corruption stay within the host kernel\u0027s security authority and do not cross a VM, IOMMU, or sandbox boundary.\\nC:H - Use-after-free of the heap-allocated rdata lets an attacker reclaim the slab and control the dangling rdata-\u003egot_bytes read (and related readdata state), yielding a kernel disclosure primitive per UAF guidance.\\nI:H - The same UAF enables heap spraying/reclaim of cifs_readdata for write and control-flow hijack primitives, and a sprayed got_bytes can also divert post-reconnect mid handling into inconsistent success paths.\\nA:H - The KASAN report shows a kernel use-after-free/oops in readpages_fill_pages on the freed rdata, so the bug denies availability even without further exploitation and is repeatedly triggerable by peer disconnects.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\", \"lessThan\": \"2b693fe3f760c87fd9768e759f6297f743a1b3b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\", \"lessThan\": \"d1fba1e096ffc7ec11df863a97c50203c47315b9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\", \"lessThan\": \"3684a2f6affa1ca52a5d4a12f04d0652efdee65e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b3160aebb49b5e07f6bc3b8c5bed6013ca9e422e\", \"lessThan\": \"aa5465aeca3c66fecdf7efcf554aed79b4c4b211\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cifs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cifs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2b693fe3f760c87fd9768e759f6297f743a1b3b0\"}, {\"url\": \"https://git.kernel.org/stable/c/d1fba1e096ffc7ec11df863a97c50203c47315b9\"}, {\"url\": \"https://git.kernel.org/stable/c/3684a2f6affa1ca52a5d4a12f04d0652efdee65e\"}, {\"url\": \"https://git.kernel.org/stable/c/aa5465aeca3c66fecdf7efcf554aed79b4c4b211\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: Fix use-after-free in rdata-\u003eread_into_pages()\\n\\nWhen the network status is unstable, use-after-free may occur when\\nread data from the server.\\n\\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\\n\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x38/0x4c\\n   print_report+0x16f/0x4a6\\n   kasan_report+0xb7/0x130\\n   readpages_fill_pages+0x14c/0x7e0\\n   cifs_readv_receive+0x46d/0xa40\\n   cifs_demultiplex_thread+0x121c/0x1490\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 2535:\\n   kasan_save_stack+0x22/0x50\\n   kasan_set_track+0x25/0x30\\n   __kasan_kmalloc+0x82/0x90\\n   cifs_readdata_direct_alloc+0x2c/0x110\\n   cifs_readdata_alloc+0x2d/0x60\\n   cifs_readahead+0x393/0xfe0\\n   read_pages+0x12f/0x470\\n   page_cache_ra_unbounded+0x1b1/0x240\\n   filemap_get_pages+0x1c8/0x9a0\\n   filemap_read+0x1c0/0x540\\n   cifs_strict_readv+0x21b/0x240\\n   vfs_read+0x395/0x4b0\\n   ksys_read+0xb8/0x150\\n   do_syscall_64+0x3f/0x90\\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n\\n  Freed by task 79:\\n   kasan_save_stack+0x22/0x50\\n   kasan_set_track+0x25/0x30\\n   kasan_save_free_info+0x2e/0x50\\n   __kasan_slab_free+0x10e/0x1a0\\n   __kmem_cache_free+0x7a/0x1a0\\n   cifs_readdata_release+0x49/0x60\\n   process_one_work+0x46c/0x760\\n   worker_thread+0x2a4/0x6f0\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n\\n  Last potentially related work creation:\\n   kasan_save_stack+0x22/0x50\\n   __kasan_record_aux_stack+0x95/0xb0\\n   insert_work+0x2b/0x130\\n   __queue_work+0x1fe/0x660\\n   queue_work_on+0x4b/0x60\\n   smb2_readv_callback+0x396/0x800\\n   cifs_abort_connection+0x474/0x6a0\\n   cifs_reconnect+0x5cb/0xa50\\n   cifs_readv_from_socket.cold+0x22/0x6c\\n   cifs_read_page_from_socket+0xc1/0x100\\n   readpages_fill_pages.cold+0x2f/0x46\\n   cifs_readv_receive+0x46d/0xa40\\n   cifs_demultiplex_thread+0x121c/0x1490\\n   kthread+0x16b/0x1a0\\n   ret_from_fork+0x2c/0x50\\n\\nThe following function calls will cause UAF of the rdata pointer.\\n\\nreadpages_fill_pages\\n cifs_read_page_from_socket\\n  cifs_readv_from_socket\\n   cifs_reconnect\\n    __cifs_reconnect\\n     cifs_abort_connection\\n      mid-\u003ecallback() --\u003e smb2_readv_callback\\n       queue_work(\u0026rdata-\u003ework)  # if the worker completes first,\\n                                 # the rdata is freed\\n          cifs_readv_complete\\n            kref_put\\n              cifs_readdata_release\\n                kfree(rdata)\\n return rdata-\u003e...               # UAF in readpages_fill_pages()\\n\\nSimilarly, this problem also occurs in the uncache_fill_pages().\\n\\nFix this by adjusts the order of condition judgment in the return\\nstatement.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.168\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.94\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.12\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"3.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:10.506Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52741\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:10.506Z\", \"dateReserved\": \"2024-05-21T15:19:24.233Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:23:03.867Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.