CVE-2024-35865: smb: client: fix potential UAF in smb2_is_valid_oplock_break()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential UAF in smb2isvalidoplockbreak()
Skip sessions that are being teared down (status == SESEXITING) to avoid UAF.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential UAF in smb2isvalidoplockbreak()
The Linux kernel CVE team has assigned CVE-2024-35865 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051939-CVE-2024-35865-c095@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.85 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Compensating control
Apply the upstream Linux kernel fix for CVE-2024-35865 (smb: client: fix potential UAF in smb2_is_valid_oplock_break()) by updating the kernel so that SMB client skips sessions being torn down (status == SES_EXITING) to avoid the UAF.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35865?
CVE-2024-35865 is classified as a medium severity vulnerability due to the potential for use-after-free conditions.
How do I fix CVE-2024-35865?
To fix CVE-2024-35865, upgrade to the kernel versions 6.1.85, 6.6.26, 6.8.5, 6.9, or appropriate Debian versions as specified.
What software is affected by CVE-2024-35865?
Software affected by CVE-2024-35865 includes various versions of the Linux kernel from Red Hat and Debian.
What type of vulnerability is CVE-2024-35865?
CVE-2024-35865 is a use-after-free vulnerability in the Linux kernel's SMB client.
Is there a known exploit for CVE-2024-35865?
As of now, there are no known public exploits for CVE-2024-35865, but it is advisable to apply patches promptly.