CVE-2024-35869: smb: client: guarantee refcounted children from parent session

Q: What is the severity of CVE-2024-35869?

CVE-2024-35869 has been classified as a moderate severity vulnerability affecting the Linux kernel.

Q: How do I fix CVE-2024-35869?

To fix CVE-2024-35869, update the kernel to the appropriate versions such as 6.6.29 for Red Hat or 6.12.11-1 for Debian.

Q: Which Linux distributions are affected by CVE-2024-35869?

CVE-2024-35869 affects various Linux distributions including certain versions of Red Hat and Debian kernels.

Q: What impact does CVE-2024-35869 have on Linux systems?

CVE-2024-35869 may lead to potential use-after-free bugs when walking DFS referrals or during failover operations.

Q: Is there a workaround for CVE-2024-35869?

Currently, the recommended preventive measure for CVE-2024-35869 is to ensure your Linux kernel is updated to the patched versions.

Published May 19, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved:

smb: client: guarantee refcounted children from parent session

Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfsseslist while we're at it, too.

Other sources

In the Linux kernel, the following vulnerability has been resolved:

smb: client: guarantee refcounted children from parent session

The Linux kernel CVE team has assigned CVE-2024-35869 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051940-CVE-2024-35869-73f8@gregkh/T

— Red Hat

Affected Software

115 affected componentsFixes available

Linux Linux kernel<6.6.29

Linux Linux kernel>=6.7<6.8.5

Linux Linux kernel=6.9-rc1

Linux Linux kernel=6.9-rc2

Linux Linux kernel>=6.2.8<6.3

Linux Linux kernel>=6.4<6.6.29

redhat/kernel<6.6.29

6.6.29

redhat/kernel<6.8.5

6.8.5

redhat/kernel<6.9

6.9

debian/linux<6.8.9-1

6.8.9-1

debian/linux<6.8.9-1

6.8.9-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1011.12~22.04.1

6.8.0-1011.12~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1010.10~22.04.1

6.8.0-1010.10~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1009.9~22.04.1

6.8.0-1009.9~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1008.8~22.04.1

6.8.0-1008.8~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-azure-fips*

ubuntu/linux<6.8.0-38.38

6.8.0-38.38

ubuntu/linux-aws<6.8.0-1011.12

6.8.0-1011.12

ubuntu/linux-azure<6.8.0-1010.10

6.8.0-1010.10

ubuntu/linux-gcp<6.8.0-1010.11

6.8.0-1010.11

ubuntu/linux-gke<6.8.0-1006.9

6.8.0-1006.9

ubuntu/linux-ibm<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-intel<6.8.0-1007.14

6.8.0-1007.14

ubuntu/linux-lowlatency<6.8.0-38.38.1

6.8.0-38.38.1

ubuntu/linux-nvidia<6.8.0-1009.9

6.8.0-1009.9

ubuntu/linux-oem-6.8<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-oracle<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-raspi<6.8.0-1007.7

6.8.0-1007.7

ubuntu/linux-riscv<6.8.0-38.38.1

6.8.0-38.38.1

ubuntu/linux-raspi-realtime<6.8.0-2006.6

6.8.0-2006.6

ubuntu/linux-realtime<6.8.1-1004.4

6.8.1-1004.4

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 6.6.29
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 6.8.5
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 6.9
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.8.9-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1011.12~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1010.10~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1009.9~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1011.12
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1010.10
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1010.11
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1006.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-intel to a version that resolves this vulnerability.
Fixed in 6.8.0-1007.14
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-38.38.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1009.9
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1007.7
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.8.0-38.38.1
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2006.6
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1004.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-35869

Event History

May 19, 2024

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverity

Data Sourced

via OSV·09:15 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·09:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

May 20, 2024

Data Sourced

via Red Hat·01:20 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-35869?

CVE-2024-35869 has been classified as a moderate severity vulnerability affecting the Linux kernel.

How do I fix CVE-2024-35869?

To fix CVE-2024-35869, update the kernel to the appropriate versions such as 6.6.29 for Red Hat or 6.12.11-1 for Debian.

Which Linux distributions are affected by CVE-2024-35869?

CVE-2024-35869 affects various Linux distributions including certain versions of Red Hat and Debian kernels.

What impact does CVE-2024-35869 have on Linux systems?

CVE-2024-35869 may lead to potential use-after-free bugs when walking DFS referrals or during failover operations.

Is there a workaround for CVE-2024-35869?

Currently, the recommended preventive measure for CVE-2024-35869 is to ensure your Linux kernel is updated to the patched versions.

CVE-2024-35869: smb: client: guarantee refcounted children from parent session

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2024-35869?

How do I fix CVE-2024-35869?

Which Linux distributions are affected by CVE-2024-35869?

What impact does CVE-2024-35869 have on Linux systems?

Is there a workaround for CVE-2024-35869?

Company

Resources

Contact