Linux Kernel ksmbd Race Condition (CVE-2023-32256): Brief Summary and Patch Overview

Introduction

Concurrent SMB2 operations on Linux file servers can cause memory corruption and information leaks, especially where multichannel connections are in use. CVE-2023-32256 is a race condition in the Linux kernel's ksmbd module that can be triggered remotely, and it threatens both the stability and the confidentiality of affected systems.

ksmbd is a kernel-space SMB server, added in recent Linux kernels for high-performance file sharing. It is increasingly used in enterprise and NAS environments as an alternative to user-space Samba. The Linux kernel runs on countless servers and embedded systems worldwide, so a flaw in its networking code reaches a very large number of machines.

Technical Information

The flaw is in how ksmbd handles concurrent SMB2 CLOSE and LOGOFF requests over multichannel connections. Session objects are not properly synchronized, which leads to a use-after-free (UAF).

Root Cause:

• When ksmbd processes a LOGOFF request, it may free the session object (sess->user) while other requests on different channels, such as CLOSE, still reference it.
• Without synchronization or reference management, there is a window in which freed memory is accessed, and the result is memory corruption or information disclosure.
• The vulnerability affects SMB2 multichannel configurations, where multiple connections can share the same session object.

Vulnerable Code Context:

The official patch commit message describes the issue:

When smb client send concurrent smb2 close and logoff request with multichannel connection, It can cause racy issue. logoff request free tcon and can cause UAF issues in smb2 close.

Vulnerability Flow:

1. Multiple SMB2 channels are established to the same session.
2. A LOGOFF request is sent on one channel and frees the session object.
3. At the same time, a CLOSE request is processed on another channel and references the now-freed session object.
4. The result is a use-after-free, which can leak memory or cause a crash.

The patch adds synchronization so that all outstanding requests complete before the session is expired and freed.

Patch Information

The race in the Linux kernel's ksmbd module occurs when the server handles concurrent SMB2 CLOSE and LOGOFF requests over multichannel connections. It could lead to use-after-free (UAF) conditions, which may crash the system or cause other unintended behavior.

With the patch, a server that receives a LOGOFF request waits for all ongoing requests on all channels to complete before it expires the session. Resources that other requests might still be using are no longer freed too early.

The fix works in two steps:

1. Before it processes a LOGOFF request, the server waits for all pending requests on every channel associated with the session to finish.
2. Only after it confirms that no active requests are using the session does the server expire and free the session resources.

This removes the race condition in ksmbd that could lead to UAF.

The full commit:

commit abcc506a9a71976a8b4c9bf3ee6efd13229c1e19
Author: Namjae Jeon <[email protected]>
Date:   Fri Jul 28 14:35:00 2023 +0900

    ksmbd: fix racy issue from smb2 close and logoff with multichannel

    When smb client send concurrent smb2 close and logoff request with
    multichannel connection, It can cause racy issue. logoff request free
    tcon and can cause UAF issues in smb2 close.

    When receiving logoff request with multichannel, ksmbd should wait until
    all remaning requests complete as well as ones in the current connection,
    and then make session expired.

    Cc: [email protected]
    Reported-by: [email protected] # ZDI-CAN-20796 ZDI-CAN-20595
    Signed-off-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>

See: Patch commit abcc506a9a71976a8b4c9bf3ee6efd13229c1e19

Affected Systems and Versions

• Linux kernel with ksmbd enabled
• Affects versions prior to 6.3.2 (patch introduced in 6.3.2 and mainline 6.4-rc1)
• Specific vulnerable versions include 4.19.90, 4.19.140, 4.19.194, 5.10.0, 6.1.0, 6.1.5, 6.1.6, 6.1.8, 6.1.14, 6.1.19
• Only systems with ksmbd (kernel-space SMB server) enabled and configured are vulnerable

Vendor Security History

The Linux kernel project has seen several ksmbd vulnerabilities in 2023, including:

• CVE-2023-32254: Memory corruption in ksmbd
• CVE-2023-32258: Use-after-free in ksmbd
• CVE-2023-32250: Out-of-bounds write in ksmbd

The kernel community typically responds quickly, releasing patches and backporting them to stable versions soon after disclosure. As a newer component, ksmbd has drawn increased attention from security researchers.

References

• NVD entry for CVE-2023-32256
• MITRE CVE entry
• Red Hat advisory
• Red Hat Bugzilla
• Patch commit abcc506a9a71976a8b4c9bf3ee6efd13229c1e19
• Zero Day Initiative advisory