CVE-2024-50120: smb: client: Handle kstrdup failures for passwords
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Handle kstrdup failures for passwords
In smb3reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures.
If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Handle kstrdup failures for passwords
In smb3reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures.
If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50120?
CVE-2024-50120 is classified as a medium severity vulnerability due to potential memory allocation failures in the Linux kernel's SMB client.
How do I fix CVE-2024-50120?
Upgrading to versions of the Linux kernel that are not affected, specifically after the patches following version 6.12-rc4, can address CVE-2024-50120.
Which Linux kernel versions are affected by CVE-2024-50120?
Linux kernel versions from 6.6.24 to 6.6.59, as well as several versions between 6.7.12 to 6.8, and 6.9 to 6.11.6 are affected by CVE-2024-50120.
What impact does CVE-2024-50120 have on system security?
CVE-2024-50120 could potentially lead to denial of service due to unhandled memory allocation failures in the SMB client.
Is CVE-2024-50120 related to any specific component of the Linux kernel?
CVE-2024-50120 specifically affects the SMB client in the Linux kernel, particularly in the password handling mechanism.