CVE-2023-52480

Katalog CVE

CVSS 7.0 · High EPSS 0,49%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada linux kernel. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race condition between ksmbd_session_lookup and ksmbd_expire_session.

Rincian

Terbit di NVD

29 Februari 2024

Terakhir diubah

15 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/18ced78b0ebccc2d16f426143dc56ab3aad666be patch
• https://git.kernel.org/stable/c/53ff5cf89142b978b1a5ca8dc4d4425e6a09745f patch
• https://git.kernel.org/stable/c/a2ca5fd3dbcc665e1169044fa0c9e3eba779202b patch
• https://git.kernel.org/stable/c/c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f patch