CVE-2023-53794
In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list.
Affected versions
Linux kernel versions
3.10.103,
3.12.63,
3.14.74,
3.16.37,
3.18.37,
4.1.28,
4.4.16,
4.6.5,
4.7
and later are affected. Fixed in
6.1.47,
6.4.12,
6.5
and their respective stable series.
References
The following references provide additional information about CVE-2023-53794 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/759ffc164d95a32c09528766d74d9b4fb054e8f4
-
PatchKernel patch commithttps://git.kernel.org/stable/c/7e4f5c3f01fb0e51ca438e43262d858daf9a0a76
-
PatchKernel patch commithttps://git.kernel.org/stable/c/99f280700b4cc02d5f141b8d15f8e9fad0418f65
Frequently asked questions
-
What is CVE-2023-53794?
CVE-2023-53794 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.10.103 onward and has been patched in 6.1.47, 6.4.12 and 6.5. CVE-2023-53794 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-53794?
Yes — CVE-2023-53794 has been patched. Fixed versions include 6.1.47, 6.4.12 and 6.5. If you are running Linux kernel 3.10.103 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-53794 actively exploited?
No — CVE-2023-53794 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.