CVE-2023-1195

What it actually does

Use-after-free in reconn_set_ipaddr_from_hostname allows invalid pointer dereference after server->hostname is freed without being nulled, resulting in kernel memory corruption or panic.

Why it matters to the business

Linux systems using CIFS network shares may experience sudden crashes and reboots, interrupting file services and causing operational downtime.

How an attack unfolds

A local attacker manipulates hostname resolution or network conditions to trigger CIFS reconnection logic, leaving a dangling pointer that is later dereferenced and crashes the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 153695d36ead0ccc4d0256953c751cabf673e621 in fs/cifs/connect.c; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the presence of the fixing commit in the kernel source tree or confirm the patched kernel version is running; test reconnection scenarios in a lab environment to ensure no crash occurs.

Typical attack path

1. Obtain local user access on a Linux host with CIFS mounts
2. Trigger hostname or IP address changes that force reconnection
3. Invoke reconn_set_ipaddr_from_hostname without proper pointer cleanup
4. Trigger use-after-free to cause kernel panic or denial of service

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for oops or panic entries referencing cifs/connect.c or reconn_set_ipaddr_from_hostname; correlate with CIFS mount or network change events.

• reconn_set_ipaddr_from_hostname
• fs/cifs/connect.c
• server->hostname
• CIFS use-after-free
• kernel BUG at fs/cifs/connect.c

What your security team should do

• Prioritize kernel updates on all systems exposing CIFS mounts
• Restrict local user privileges on multi-user Linux servers until patched
• Enable kernel panic logging and monitor for CIFS-related oops messages
• Consider disabling unnecessary CIFS client functionality where feasible