# CVE-2023-52741: linux: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pag... CVE-2023-52741 is fixed in 20 products on 1 platform, first by ALAS2023-2023-132, released March 11, 2023. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2023-52741 - Priority: High - CVSS: 7.8 (high) - EPSS: 0.0073 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 11, 2023 ## Description In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata->read_into_pages() When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0 Call Trace: dump_stack_lvl+0x38/0x4c print_report+0x16f/0x4a6 kasan_report+0xb7/0x130 readpages_fill_pages+0x14c/0x7e0 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Allocated by task 2535: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x82/0x90 cifs_readdata_direct_alloc+0x2c/0x110 cifs_readdata_alloc+0x2d/0x60 cifs_readahead+0x393/0xfe0 read_pages+0x12f/0x470 page_cache_ra_unbounded+0x1b1/0x240 filemap_get_pages+0x1c8/0x9a0 filemap_read+0x1c0/0x540 cifs_strict_readv+0x21b/0x240 vfs_read+0x395/0x4b0 ksys_read+0xb8/0x150 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 79: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 __kmem_cache_free+0x7a/0x1a0 cifs_readdata_release+0x49/0x60 process_one_work+0x46c/0x760 worker_thread+0x2a4/0x6f0 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x95/0xb0 insert_work+0x2b/0x130 __queue_work+0x1fe/0x660 queue_work_on+0x4b/0x60 smb2_readv_callback+0x396/0x800 cifs_abort_connection+0x474/0x6a0 cifs_reconnect+0x5cb/0xa50 cifs_readv_from_socket.cold+0x22/0x6c cifs_read_page_from_socket+0xc1/0x100 readpages_fill_pages.cold+0x2f/0x46 cifs_readv_receive+0x46d/0xa40 cifs_demultiplex_thread+0x121c/0x1490 kthread+0x16b/0x1a0 ret_from_fork+0x2c/0x50 The following function calls will cause UAF of the rdata pointer. readpages_fill_pages cifs_read_page_from_socket cifs_readv_from_socket cifs_reconnect __cifs_reconnect cifs_abort_connection mid->callback() --> smb2_readv_callback queue_work(&rdata->work) # if the worker completes first, # the rdata is freed cifs_readv_complete kref_put cifs_readdata_release kfree(rdata) return rdata->... # UAF in readpages_fill_pages() Similarly, this problem also occurs in the uncache_fill_pages(). Fix this by adjusts the order of condition judgment in the return statement. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | bpftool-debuginfo amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-debuginfo amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-debuginfo-common-aarch64 amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-debuginfo-common-x86_64 amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-devel amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-headers amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-libbpf amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-libbpf-devel amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-libbpf-static amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-livepatch-6.1.12-17.42 amzn 2023 | 1.0-0.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-tools amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-tools-debuginfo amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | kernel-tools-devel amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | linux Debian 12.15 (bookworm) | 6.1.12-1 | [DEBIAN-CVE-2023-52741](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52741.md) | May 21, 2024 | | Linux | linux Debian 13.5 (trixie) | 6.1.12-1 | [DEBIAN-CVE-2023-52741](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52741.md) | May 21, 2024 | | Linux | linux Debian 14 | 6.1.12-1 | [DEBIAN-CVE-2023-52741](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52741.md) | May 21, 2024 | | Linux | perf amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | perf-debuginfo amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | python3-perf amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | | Linux | python3-perf-debuginfo amzn 2023 | 6.1.12-17.42.amzn2023 | [ALAS2023-2023-132](https://patchblox.com/security/data/fix/linux/alas2023-2023-132.md) | Mar 11, 2023 | --- Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.