CVE-2024-53179

What it actually does

Race condition during SMB2.1 session setup allows one task to free the signing key response while another task still references it for signature calculation, resulting in use-after-free on auth_key.response.

Why it matters to the business

Kernel instability or potential code execution during network file mounts can disrupt shared storage access, increase crash rates on systems using signed SMB connections, and require urgent patching to maintain operational continuity.

How an attack unfolds

An attacker triggers concurrent cifs_mount and cifs_send_recv paths on an SMB2.1 signed mount so that kfree_sensitive in session teardown races with crypto_shash_setkey in signature computation, dereferencing the freed key buffer.

How to fix it

Apply the kernel patch that guards access to ses->auth_key.response by checking ses_status under ses_lock; update to a kernel version containing commit that enforces SES_GOOD or SES_EXITING checks before signing operations.

How to confirm the fix worked

Confirm ses_status checks are present in cifs_get_smb_ses and smb2_setup_request paths; run targeted SMB mount/unmount stress tests with signing enabled and verify absence of UAF reports in kernel logs.

Typical attack path

1. Mount SMB share with signing enabled via SMB2.1
2. Trigger parallel session setup and request processing
3. Force session teardown while signature calculation is in progress
4. Access freed auth_key.response buffer during crypto operation

How to detect it

Inspect kernel logs for slab-use-after-free warnings referencing auth_key or smb2_calc_signature; correlate with cifs_mount activity and compound_send_recv calls around the time of crashes.

What your security team should do

• Prioritize kernel updates on all systems using signed SMB2.1 mounts
• Monitor for kernel oops or slab corruption related to cifs sessions
• Restrict SMB signing usage to patched kernels until remediation is complete