Bugzilla – Bug 1224745
VUL-0: REJECTED: CVE-2023-52666: kernel: ksmbd: fix potential circular locking issue in smb2_set_ea()
Last modified: 2024-06-12 08:41:28 UTC
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential circular locking issue in smb2_set_ea() smb2_set_ea() can be called in parent inode lock range. So add get_write argument to smb2_set_ea() not to call nested mnt_want_write(). References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52666 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52666.mbox https://git.kernel.org/stable/c/5349fd419e4f685d609c85b781f2b70f0fb14848 https://git.kernel.org/stable/c/e61fc656ceeaec65f19a92f0ffbeb562b7941e8d https://git.kernel.org/stable/c/e9ec6665de8f706b4f4133b87b2bd02a159ec57b https://git.kernel.org/stable/c/ecfd93955994ecc2a1308f5ee4bd90c7fca9a8c6 https://git.kernel.org/stable/c/6fc0a265e1b932e5e97a038f99e29400a93baad0 https://www.cve.org/CVERecord?id=CVE-2023-52666 https://bugzilla.redhat.com/show_bug.cgi?id=2281352
https://www.suse.com/security/cve/CVE-2023-52666.html cvss 5.5
commit 6fc0a265e1b932e5e97a038f99e29400a93baad0 [v6.8-rc1] Author: Namjae Jeon <linkinjeon@kernel.org> Date: Fri Dec 15 08:33:57 2023 +0900 ksmbd: fix potential circular locking issue in smb2_set_ea() smb2_set_ea() can be called in parent inode lock range. So add get_write argument to smb2_set_ea() not to call nested mnt_want_write(). Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> joeyli@linux-691t:/mnt/working/source_code-git/kernel-source> ./scripts/check-kernel-fix CVE-2023-52666 6fc0a265e1b9 ("ksmbd: fix potential circular locking issue in smb2_set_ea()") merged v6.8-rc1~113^2~8 No Fixes tag. Requires manual review for affected branches. Security fix for CVE-2023-52666 bsc#1224745 with CVSS 5.5 .............................. ACTION NEEDED! SLE15-SP6: MANUAL: might need backport of 6fc0a265e1b932e5e97a038f99e29400a93baad0 () SLE15-SP5: MANUAL: might need backport of 6fc0a265e1b932e5e97a038f99e29400a93baad0 () SLE12-SP5: MANUAL: might need backport of 6fc0a265e1b932e5e97a038f99e29400a93baad0 () SLE12-SP3-TD: MANUAL: might need backport of 6fc0a265e1b932e5e97a038f99e29400a93baad0 ()
Hi Enzo, Because this issue is for smb. Could you please help to handle it? If this is not in your area, just reset bug assigner to kernel-bugs@suse.de. Kernel Security Sentinel will find other expert. Thanks a lot!
Closing this issue as RESOLVED/INVALID as ksmbd is disabled in SLE.
REJECTED: https://lore.kernel.org/linux-cve-announce/2024061244-REJECTED-1c53@gregkh/T/#u