{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53052","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:18:43.828Z","datePublished":"2025-05-02T15:55:07.755Z","dateUpdated":"2026-08-05T09:12:33.775Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:12:33.775Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix use-after-free bug in refresh_cache_worker()\n\nThe UAF bug occurred because we were putting DFS root sessions in\ncifs_umount() while DFS cache refresher was being executed.\n\nMake DFS root sessions have same lifetime as DFS tcons so we can avoid\nthe use-after-free bug is DFS cache refresher and other places that\nrequire IPCs to get new DFS referrals on.  Also, get rid of mount\ngroup handling in DFS cache as we no longer need it.\n\nThis fixes below use-after-free bug catched by KASAN\n\n[ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56\n[ 379.948096]\n[ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23\n[ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014\n[ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs]\n[ 379.949942] Call Trace:\n[ 379.950113] <TASK>\n[ 379.950260] dump_stack_lvl+0x50/0x67\n[ 379.950510] print_report+0x16a/0x48e\n[ 379.950759] ? __virt_addr_valid+0xd8/0x160\n[ 379.951040] ? __phys_addr+0x41/0x80\n[ 379.951285] kasan_report+0xdb/0x110\n[ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs]\n[ 379.953637] ? __pfx___mutex_lock+0x10/0x10\n[ 379.953915] ? lock_release+0xb6/0x720\n[ 379.954167] ? __pfx_lock_acquire+0x10/0x10\n[ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs]\n[ 379.954960] ? __pfx_wb_workfn+0x10/0x10\n[ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs]\n[ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs]\n[ 379.956323] ? __pfx_lock_acquired+0x10/0x10\n[ 379.956615] ? read_word_at_a_time+0xe/0x20\n[ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220\n[ 379.957235] process_one_work+0x535/0x990\n[ 379.957509] ? __pfx_process_one_work+0x10/0x10\n[ 379.957812] ? lock_acquired+0xb7/0x5f0\n[ 379.958069] ? __list_add_valid+0x37/0xd0\n[ 379.958341] ? __list_add_valid+0x37/0xd0\n[ 379.958611] worker_thread+0x8e/0x630\n[ 379.958861] ? __pfx_worker_thread+0x10/0x10\n[ 379.959148] kthread+0x17d/0x1b0\n[ 379.959369] ? __pfx_kthread+0x10/0x10\n[ 379.959630] ret_from_fork+0x2c/0x50\n[ 379.959879] </TASK>"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - This is the SMB client (fs/cifs), not an in-kernel network server; the free side is local umount/automount expiry (cifs_umount → dfs_cache_put_refsrv_sessions) racing the dfscache workqueue, so exploitation requires local system access.\nAC:L - The attacker drives both sides by triggering DFS automounts (or mount/umount) against a share while refresh_cache_worker runs on attacker-influenced referral TTLs, and can retry the umount-vs-worker race indefinitely.\nPR:L - cifs lacks FS_USERNS_MOUNT for ordinary mounts, but any unprivileged user who can traverse an existing DFS CIFS mount can trigger cifs_dfs_d_automount → fc_mount (no mount_capable check) and later automount expiry into cifs_umount, reaching the UAF without CAP_SYS_ADMIN.\nUI:N - The attacker performs the path-walk/automount and races the cache refresher themselves; an already-mounted DFS share is an environmental precondition, not a victim action at exploit time.\nS:U - The use-after-free is in host kernel heap objects (struct cifs_ses / tcon_ipc) and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - __refresh_tcon reads fields from a freed DFS root cifs_ses (ses->tcon_ipc and later session state); per UAF guidance this enables heap reuse and an arbitrary kernel memory disclosure primitive.\nI:H - The same freed session object can be sprayed/reclaimed before the worker continues, yielding a classic heap UAF write/control-flow hijack primitive against kernel memory.\nA:H - Even without full exploitation, the KASAN-reported use-after-free in __refresh_tcon causes kernel oops/panic and is repeatedly triggerable via the umount/automount race."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/cifs_fs_sb.h","fs/cifs/cifsglob.h","fs/cifs/connect.c","fs/cifs/dfs.c","fs/cifs/dfs.h","fs/cifs/dfs_cache.c","fs/cifs/dfs_cache.h","fs/cifs/misc.c"],"versions":[{"version":"6916881f443f67f6893b504fa2171468c8aed915","lessThan":"5a89d81c1a3c152837ea204fd29572228e54ce0b","status":"affected","versionType":"git"},{"version":"6916881f443f67f6893b504fa2171468c8aed915","lessThan":"396935de145589c8bfe552fa03a5e38604071829","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/cifs_fs_sb.h","fs/cifs/cifsglob.h","fs/cifs/connect.c","fs/cifs/dfs.c","fs/cifs/dfs.h","fs/cifs/dfs_cache.c","fs/cifs/dfs_cache.h","fs/cifs/misc.c"],"versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","status":"unaffected","versionType":"semver"},{"version":"6.2.8","lessThanOrEqual":"6.2.*","status":"unaffected","versionType":"semver"},{"version":"6.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.2.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5a89d81c1a3c152837ea204fd29572228e54ce0b"},{"url":"https://git.kernel.org/stable/c/396935de145589c8bfe552fa03a5e38604071829"}],"title":"cifs: fix use-after-free bug in refresh_cache_worker()","x_generator":{"engine":"bippy-1.2.0"}}}}