CVE-2024-50152: smb: client: fix possible double free in smb2_set_ea()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix possible double free in smb2setea()
Clang static checker(scan-build) warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfree(ea); | ^~~~~~~~~
There is a double free in such case: 'ea is initialized to NULL' -> 'first successful memory allocation for ea' -> 'something failed, goto seaexit' -> 'first memory release for ea' -> 'goto replayagain' -> 'second goto seaexit before allocate memory for ea' -> 'second memory release for ea resulted in double free'.
Re-initialie 'ea' to NULL near to the replayagain label, it can fix this double free problem.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix possible double free in smb2setea()
Clang static checker(scan-build) warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfree(ea); | ^~~~~~~~~
There is a double free in such case: 'ea is initialized to NULL' -> 'first successful memory allocation for ea' -> 'something failed, goto seaexit' -> 'first memory release for ea' -> 'goto replayagain' -> 'second goto seaexit before allocate memory for ea' -> 'second memory release for ea resulted in double free'.
Re-initialie 'ea' to NULL near to the replayagain label, it can fix this double free problem.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1 - Configuration
In smb2_set_ea(), re-initialize 'ea' to NULL near the 'replay_again' label to prevent the double free path described (second goto 'sea_exit' before memory allocation for ea).
Linux kernel (fs/smb/client/smb2ops.c) ea re-initialization = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50152?
CVE-2024-50152 has not been officially assigned a severity rating, but it involves a possible double free vulnerability which can lead to memory corruption.
How do I fix CVE-2024-50152?
To fix CVE-2024-50152, ensure that you upgrade to the latest version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50152?
CVE-2024-50152 affects Linux kernel versions from 6.8 to 6.11.6 and includes the 6.12-rc1, 6.12-rc2, and 6.12-rc3 releases.
What vulnerability type is CVE-2024-50152?
CVE-2024-50152 is classified as a memory management vulnerability due to a possible double free scenario.
Is CVE-2024-50152 exploitable?
While CVE-2024-50152 presents a potential security risk due to double freeing of memory, specific exploitability depends on the context of use.