CVE-2023-5345

What it actually does

Use-after-free in the Linux kernel SMB3 client fs/smb/client component where an error path in smb3_fs_context_parse_param frees ctx->password without clearing the pointer, enabling a subsequent double-free that can be leveraged for local privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can gain full root access, allowing them to compromise the host, access sensitive data, or persist within the environment; the issue affects any kernel build incorporating the SMB client code and has remained unpatched on many systems for years.

How an attack unfolds

An attacker with local access supplies malformed parameters during SMB filesystem context parsing to trigger the error path, causing the password buffer to be freed twice; the resulting use-after-free condition is then used to corrupt kernel memory structures and execute arbitrary code with elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 or later; rebuild and redeploy any custom kernels that include the SMB client component; verify the fix is present by checking the commit hash in the source tree.

How to confirm the fix worked

Confirm the running kernel source contains commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705; test that SMB3 context parsing no longer frees the password pointer without nulling it; review kernel build logs and package manifests for the patched version across all distributions and custom builds.

Typical attack path

1. Obtain local shell access on a target Linux system
2. Trigger SMB3 mount or parameter parsing with crafted input that hits the error path in smb3_fs_context_parse_param
3. Exploit the double-free/use-after-free to corrupt kernel memory
4. Escalate privileges to root and execute payload

How to detect it

Review kernel audit logs and system call traces for unusual SMB3 mount or parameter parsing activity; look for crashes or warnings in dmesg related to fs/smb/client; examine process execution history for local users attempting to trigger SMB context errors on systems that may still be vulnerable.

What your security team should do

• Prioritize patching all Linux systems that use the SMB client to the fixed commit within the next maintenance window
• Inventory kernels and rebuild pipelines to ensure the SMB client code is updated before deployment
• Monitor for local privilege-escalation attempts on systems where patching is delayed