CVE-2024-50285: ksmbd: check outstanding simultaneous SMB operations
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: check outstanding simultaneous SMB operations
If Client send simultaneous SMB operations to ksmbd, It exhausts too much memory through the "ksmbdworkcache”. It will cause OOM issue. ksmbd has a credit mechanism but it can't handle this problem. This patch add the check if it exceeds max credits to prevent this problem by assuming that one smb request consumes at least one credit.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Upgrade
Upgrade
Linux kernel ksmbdto a version that resolves this vulnerability.Patch ksmbd: check outstanding simultaneous SMB operations
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50285?
CVE-2024-50285 has a high severity rating due to its potential to cause out-of-memory (OOM) issues by exhausting memory with simultaneous SMB operations.
How do I fix CVE-2024-50285?
To fix CVE-2024-50285, update to the latest version of the Linux Kernel that addresses this vulnerability.
Which versions of the Linux Kernel are affected by CVE-2024-50285?
CVE-2024-50285 affects Linux Kernel versions up to 6.6.61, between 6.7 and 6.11.8, and specific release candidates from 6.12.
What systems are at risk for CVE-2024-50285?
Systems running affected versions of the Linux Kernel with ksmbd enabled are at risk for CVE-2024-50285.
What impact does CVE-2024-50285 have on smb operations?
CVE-2024-50285 can lead to excessive memory consumption during simultaneous SMB operations, potentially resulting in service disruption.