CVE-2024-42256

CVE-2024-42256

High · published August 8, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

⚠️ A server side misaccounting issue in the Linux kernel could send your network's data handling into disarray! Think of it like a restaurant where the server accidentally charges two different tables for the same meal, leading to a chaotic situation. If orders aren’t properly tracked, some tables might end up paying for dishes they never ordered! This bug can manifest as warning messages about incorrect credit accounting in network operations, potentially affecting data transfers. While not actively exploited, this could lead to inefficiencies and confusion during higher-demand tasks, especially in multi-channel setups, impacting overall system performance.

Put simply

Think of it like a restaurant where the server accidentally charges two different tables for the same meal, leading to a chaotic situation. If orders aren’t properly tracked, some tables might end up paying for dishes they never ordered! The vulnerability arises when a cifs subrequest retry causes the server to be repicked, leading to a mismatch in tracking requests. This results in improper incrementing and decrementing of the server's in-flight requests when issuing writes.

What to do

This bug can manifest as warning messages about incorrect credit accounting in network operations, potentially affecting data transfers. While not actively exploited, this could lead to inefficiencies and confusion during higher-demand tasks, especially in multi-channel setups, impacting overall system performance. To mitigate this, ensure your Linux kernel version is updated to the latest patch where this issue is resolved. Regularly check for updates and apply them to maintain server integrity and performance. You’ve got this! Keep your systems updated, and you’ll maintain that security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00688 · 52.1th percentile
Published
2024-08-08T13:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 6.10, < 6.10.16.10.1
References (2)
EPSS history
Timeline
  • 08 AUG 08:49Z
    cifs: Fix server re-repick on subrequest retry
    cvelistv5