CVE-2024-42307: cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix potential null pointer use in destroyworkqueue in initcifs error path
Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 initcifs() error: we previously assumed 'serverclosewq' could be null (see line 1895)
The patch which introduced the serverclose workqueue used the wrong oredering in error paths in initcifs() for freeing it on errors.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42307?
The severity of CVE-2024-42307 is classified as Medium due to the potential for causing a null pointer dereference.
How do I fix CVE-2024-42307?
To resolve CVE-2024-42307, update to the recommended versions of the Linux kernel that have addressed the vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-42307?
CVE-2024-42307 affects Linux kernel versions between 6.1.85 and 6.1.103, as well as versions between 6.6.26 and 6.6.44, and between 6.8.5 and 6.10.3.
Who reported the CVE-2024-42307 vulnerability?
The vulnerability CVE-2024-42307 was reported by Dan Carpenter.
Does CVE-2024-42307 impact any specific distributions?
Yes, CVE-2024-42307 impacts various distributions using affected versions of the Linux kernel, including Debian.