CoreCVE
Back

MEDIUM

Use-after-free in smb2_is_status_io_timeout()

Published Nov 1, 2023

Description

A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat statement

Because analysis indicates that this issue will only cause momentary interruptions to connections, Red Hat rates the impact of this flaw as Low.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (1)

CWE-416

Use After Free

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 1, 2023
Updated Feb 27, 2025
Reserved Mar 6, 2023
Link CVE-2023-1192
CISA Vulnrichment
Updated Feb 26, 2025
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2023-1192
Red Hat
Severity Low
Public date Oct 2, 2022
Links CVE-2023-1192 - Bugzilla