CVE-2024-50283: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix slab-use-after-free in smb3preauthhashrsp
ksmbdusersessionput should be called under smb3preauthhashrsp(). It will avoid freeing session before calling smb3preauthhashrsp().
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50283?
CVE-2024-50283 is considered to be of medium severity due to the potential for use-after-free vulnerabilities in the Linux kernel's ksmbd.
How do I fix CVE-2024-50283?
To fix CVE-2024-50283, update to a fixed version of the Linux kernel that addresses the issue, such as versions after the vulnerability was patched.
Which versions of the Linux kernel are affected by CVE-2024-50283?
CVE-2024-50283 affects multiple versions of the Linux kernel including those between 6.2 and 6.1.117, 6.7 and 6.11.8, as well as specific release candidates.
What component of the Linux kernel is impacted by CVE-2024-50283?
CVE-2024-50283 impacts the ksmbd component of the Linux kernel, specifically in the handling of smb3_preauth_hash_rsp.
What are the implications of not addressing CVE-2024-50283?
Failure to address CVE-2024-50283 could lead to security risks, potentially allowing attackers to exploit memory corruption vulnerabilities.