Linux Kernel Vulnerability in CIFS Transport Mechanism

CVE-2023-53597

What is CVE-2023-53597?

A vulnerability in the Linux kernel affects its Common Internet File System (CIFS) transport mechanism. When multiple I/O timeout statuses occur, the system fails to properly manage 'mid' identifiers and credits associated with ongoing requests. This results in potential issues with the 'in_flight' request count and leads to a resource leak. Additionally, the original reconnection procedure only targeted the transport connection, neglecting the entire session and its associated resources, especially in multi-channel setups. Recent updates have shifted the error handling logic to ensure appropriate resource management, enhancing system stability and security.

References