CVE-2024-50285CWE-770denial-of-service

CVE-2024-50285

High · published November 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: check outstanding simultaneous SMB operations

If Client send simultaneous SMB operations to ksmbd, It exhausts too much

memory through the "ksmbd_work_cache”. It will cause OOM issue.

ksmbd has a credit mechanism but it can't handle this problem. This patch

add the check if it exceeds max credits to prevent this problem by assuming

that one smb request consumes at least one credit.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00597 · 47.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-11-19T07:16Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel< 6.6.616.6.61
linux/linux_kernel≥ 6.7, < 6.11.86.11.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
https://git.kernel.org/stable/c/0a77d947f599b1f39065015bec99390d0c0022ee · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1f993777275cbd8f74765c4f9d9285cb907c9be5 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e257ac6fe138623cf59fca8898abdf659dbc8356 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 NOV 01:30Z
    ksmbd: check outstanding simultaneous SMB operations
    cvelistv5