CVE-2023-1192

What it actually does

Use-after-free in smb2_is_status_io_timeout() within the Linux kernel CIFS module; local variables retain pointers to memory after a system call frees the region, allowing the module to dereference freed memory and trigger a kernel crash.

Why it matters to the business

Linux systems performing SMB/CIFS file operations may experience abrupt crashes or service unavailability, interrupting file-sharing workloads and dependent applications with no confidentiality or integrity loss but clear availability impact.

How an attack unfolds

An attacker reachable over the network supplies crafted SMB2 responses to a Linux CIFS client; the responses cause response data to be handed to a system call that frees the buffer before the timeout-checking function accesses it, resulting in a use-after-free and denial of service.

How to fix it

Upgrade the Linux kernel to a build containing commit d527f51331cace562393a8038d870b3e9916686f (or any later equivalent mainline or distribution backport).

How to confirm the fix worked

Confirm the running kernel contains commit d527f51331cace562393a8038d870b3e9916686f; exercise CIFS mounts and SMB2 I/O while monitoring for oops/panics referencing the affected function.

Typical attack path

1. Obtain network reachability to a Linux system acting as a CIFS client
2. Initiate or intercept an SMB2 session and exchange response data
3. Trigger the smb2_is_status_io_timeout path with timing that races the system-call free
4. Force kernel dereference of freed memory and induce panic or hang

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic entries that mention CIFS or the smb2_is_status_io_timeout function around the time of service interruption.

What your security team should do

• Apply the referenced kernel commit or distribution update to all systems using CIFS
• Temporarily disable CIFS mounts or restrict SMB servers to trusted endpoints until patched
• Include kernel CIFS crash signatures in monitoring and alerting rules