CVE-2023-54280

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The race is in the CIFS/SMB client's DFS reconnect path and is driven entirely by remote peer behaviour — a malicious or compromised SMB/DFS server (or an on-path attacker resetting the TCP session) controls when reconnects occur and which failover targets are returned, and the leaked heap bytes are sent back to that server in the TREE_CONNECT request. Both racing threads (cifsd demux thread and the cifsiod reconnect worker) run automatically over the network connection with no local component.

AC:LAttack complexity, low

The attacker controls both sides of the race: dropping the TCP connection forces cifsd into reconnect_dfs_server()/__reconnect_target_unlocked() which kfree()s server->hostname, while the referral target list it supplies guarantees the free happens, and the cifsiod reconnect worker concurrently reads the pointer unlocked. reconnect_dfs_server() retries in a msleep(3000) loop so the window can be hit repeatedly until it lands.

PR:NPrivileges required, none

The attacker acts as the SMB/DFS server or as a network attacker on the connection and never authenticates to or holds any account on the victim host. The vulnerable reconnect path runs in kernel threads (cifsd and the cifsiod reconnect worker), so no privileged or unprivileged local process is needed at all.

UI:NUser interaction, none

Against an already-mounted DFS share — the normal persistent state for enterprise fstab/autofs mounts — the entire trigger sequence is kernel-internal: cifsd drops and re-establishes the connection and queues smb2_reconnect_server(), which reaches __tree_connect_dfs_target() with no user process and no victim action.

S:UScope, unchanged

The use-after-free is confined to kernel heap memory of the affected host and does not cross a virtualization, IOMMU, or sandbox boundary. Impact and vulnerable component share the same security authority.

C:HConfidentiality impact, high

The freed hostname buffer is formatted with "%s", and string_nocheck() runs with precision -1 (`while (lim--)`), so it reads freed and reallocated heap memory unbounded until a NUL byte, copying up to ~500 bytes into the tree name, which is then transmitted to the remote attacker-controlled server in the SMB2 TREE_CONNECT request — a direct kernel heap disclosure primitive.

I:HIntegrity impact, high

This is a use-after-free on an attacker-influenced heap object; an attacker who grooms the reallocated kmalloc chunk controls the string used to build the IPC$ tree-connect request, steering the client's connection state, and UAF conditions on the CIFS server/session objects are generally leverageable for stronger corruption primitives.

A:HAvailability impact, high

The unbounded scan for a NUL over the freed allocation readily walks off the slab object into unmapped memory, producing a kernel oops/panic (and an immediate KASAN BUG on hardened kernels). The remote attacker can retrigger the reconnect race repeatedly until the client crashes.