In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear ce->tgthint in free_tgts()
When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.
If ce->tgthint is not reset before it is used later, it results
in a use-after-free.
Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 6
https://git.kernel.org/stable/c/5baab40404a9393bcc0b7b8f1950bf2c307e0984
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7507bd1885643d0461a6017767492450af1ce2a3
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9ab46a13798a61d9d020b01d4e57efdabe6624fa
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b1b741cf8e7ce1b91d937e23decd3d3358748700
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/14f60e959b5ac813715ff72e127beb3584ddabf6
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3ff9462bb7a06d8d32a1dc02d39580b078ec9e55
416baaa9-dc9f-4396-8d5f-8c081fb06d67