Review reviewHigh

CVE-2023-52480

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_active = jiffies | + This patch add rwsem to fix race condition between ksmbd_session_lookup and ksmbd_expire_session.

CVSS: 7
EPSS: 0.48%
CISA KEV: Not listed
Published: 2024.02.29

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.48%

Technical severityCVSS 7

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 0626e6641f6b467447c81dd7678a69c66f7746cf < c77fd3e25a51ac92b0f1b347a96eff6a0b4f066f, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < a2ca5fd3dbcc665e1169044fa0c9e3eba779202b, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 18ced78b0ebccc2d16f426143dc56ab3aad666be, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 53ff5cf89142b978b1a5ca8dc4d4425e6a09745f, >= 5.15, >= 5.15 < 5.15.145, >= 5.16 < 6.1.57, >= 6.2 < 6.5.7, 6.6
Fixed versions: 5.15.145, 6.1.57, 6.5.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-362