CVE-2024-50286CWE-416

CVE-2024-50286

Critical · published November 19, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

There is a race condition between ksmbd_smb2_session_create and

ksmbd_expire_session. This patch add missing sessions_table_lock

while adding/deleting session from global session table.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00670 · 51.4th percentile
Weakness
CWE-416 · Use After Free
Published
2024-11-19T07:16Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel< 6.1.1176.1.117
linux/linux_kernel≥ 6.2, < 6.6.616.6.61
linux/linux_kernel≥ 6.7, < 6.11.86.11.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
https://git.kernel.org/stable/c/0a77715db22611df50b178374c51e2ba0d58866e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e7a2ad2044377853cf8c59528dac808a08a99c72 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e923503a56b3385b64ae492e3225e4623f560c5b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f56446ba5378d19e31040b548a14ee9a8f1500ea · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 NOV 01:30Z
    ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
    cvelistv5