Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - smbclient修复 smb2_query_info_compound() 中的释放后使用对 Windows Server 2022 和挂载选项 'multichannel,max_channels=2,vers3.1.1= noperm' BUGKASANsmb2_query_info_compound+0x423/0x6d0 [cifs] 由任务 xfs_io/27534 CPU: 0 PID: 27534 Comm: xfs_io 未受感染在 addr ffff888014941048 处读取大小 8 #1 硬件名称QEMU Standard PCQ35 + ICH92009BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 调用跟踪dump_stack_lvl+0x4a/0x80 print_report+0xcf/ 0x650 ? srso_alias_return_thunk+0x5/0x7f srso_alias_return_thunk+0x5/0x7f
    __phys_addr+0x46/0x90 kasan_report+0xda/0x110 smb2_query_info_compound+0x423/0x6d0 [cifs] ? smb2_query_info_compound+0x423/0x6d0 [cifs] smb2_query_info_compound+0x423/0x6d0 [cifs] ?
    __pfx_smb2_query_info_compound+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f
    __stack_depot_save+0x39/0x480 ? kasan_save_stack+0x33/0x60 ? kasan_set_track+0x25/0x30
    ____kasan_slab_free+0x126/0x170 smb2_queryfs+0xc2/0x2c0 [cifs] ? __pfx_smb2_queryfs+0x10/0x10 [cifs] ?
    __pfx___lock_acquire+0x10/0x10 smb311_queryfs+0x210/0x220 [cifs] ? __pfx_smb311_queryfs+0x10/0x10 [cifs] ? srso_alias_return_thunk+0x5/0x7f __lock_acquire+0x480/0x26c0 ? lock_release+0x1ed/0x640 ? srso_alias_return_thunk+0x5/0x7f do_raw_spin_unlock+0x9b/0x100 cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0 __do_sys_fstatfs+0x7f/0xe0 ?
    __pfx___do_sys_fstatfs+0x10/0x10 ? srso_alias_return_thunk+0x5/0x7f lockdep_hardirqs_on_prepare+0x136/0x200 srso_alias_return_thunk+0x5/0x7f do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 27534: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 open_cached_dir+0x71b/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs ] smb2_queryfs+0xc2/0x2c0 [cifs] smb311_queryfs+0x210/0x220 [cifs] cifs_statfs+0x18c/0x4b0 [cifs] statfs_by_dentry+0x9b/0xf0 fd_statfs+0x4e/0xb0
    __do_sys_fstatfs+0x7f/0xe0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 由任务 27534释放kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50
    ____kasan_slab_free+0x126/0x170 slab_free_freelist_hook+0xd0/0x1e0 __kmem_cache_free+0x9d/0x1b0 open_cached_dir+0xff5/0x1240 [cifs] smb2_query_info_compound+0x5c3/0x6d0 [cifs] smb2_queryfs+0xc2/0x2c0 [cifs] This is a race between open_cached_dir() and cached_dir_lease_break( ) 其中为开放的目录句柄的缓存条目在创建时接收到租用中断。在从 open_cached_dir() 返回之前我们因为 !@cfid->has_lease 放置了新 @cfid 的最后一个引用。除了 UAF 之外还可以在运行 xfstests 时在对缓存的 fid 运行多个并发 statfs(2) 调用的测试中发现大量租用中断 CIFS: VFS: ://w22-root1.gandalf.test 没有要唤醒的任务未知框架... CIFS: VFS: ://w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFSVFS
    \w22-root1.gandalf.test smb buf 00000000715bfe83 len 108 CIFSVFS转储待定请求CIFSVFS
    ========================================================================================================================================... CIFS: VFS: ://w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1... CIFSVFS://w22-root1.gandalf.test smb buf 000000005aa7316e len 108 ... 要修复这两个问题请在 open_cached_dir() 中确保在发出复合请求前设定 @cfid->has_lease以便在缓存 @cfid 时多路分解线程能够处理任何潜在的租用中断。并且如果 open 由于某种原因失败则重新检查 @cfid->has_lease 以决定是否放置租用引用。 (CVE-2023-52751)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2023-52751

high Nessus 插件 ID 226143

版本 1.10