CVE-2024-53179

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The vulnerable `smb2_calc_signature()` runs in the cifs demultiplex thread on every inbound signed SMB2/2.1 response (`smb2_check_receive` → `smb2_verify_signature`), while the freeing side (`cifs_setup_session()`) is entered on reconnect or DFS re-referral — both driven by the remote SMB server dropping the TCP connection or serving referrals. A malicious, compromised, or spoofed server (or an on-path attacker injecting RSTs) controls both halves of the race purely over the network.

AC:LAttack complexity, low

The attacker owns both sides of the race and the window is server-timed: after the free, `auth_key.response` stays NULL across the entire multi-round-trip NTLMSSP handshake, whose latency the server dictates, while `SMB2_IOCTL`/`SMB2_TREE_CONNECT` deliberately bypass the reconnect serialization in `smb2_reconnect()` and go straight to signing. Triggering is repeatable and reliable, not dependent on any condition outside attacker control.

PR:NPrivileges required, none

No credentials on the client are needed — the demultiplex/signing path performs no capability or permission check, and the remote peer needs no authentication to tear down the TCP connection or drive session re-setup on an existing mount. The attacker is the network peer, not a local user.

UI:NUser interaction, none

Against an already-established SMB2.1 signed mount the attacker forces reconnects and session re-setup at will; no administrator or user action is required at exploitation time. Concurrent requests are supplied by ordinary background client activity (echo, DFS referral, oplock traffic).

S:UScope, unchanged

The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The freed heap object is read and consumed as the HMAC-SHA256 signing key, and the resulting signature is transmitted back to the attacker, forming an oracle over reallocated kernel heap contents. The attacker additionally controls the object's kmalloc size class via the server-supplied NTLMSSP `TargetInfoArray.Length`, making the UAF read a groomable arbitrary-disclosure primitive.

I:HIntegrity impact, high

Because the attacker selects the slab and can refill the freed 16 bytes, the client can be made to sign SMB traffic with a key the attacker knows, destroying the integrity guarantee of SMB signing and enabling forged/modified filesystem traffic. As a use-after-free it also carries the standard heap-corruption path to control-flow hijack.

A:HAvailability impact, high

Once `auth_key.response` is NULLed, `crypto_shash_setkey(tfm, NULL, 16)` dereferences NULL and oopses the kernel; on the send path this occurs while `server->srv_mutex` is held, permanently wedging all further I/O on that mount. Customers reported this as a production crash.