CVE-2024-35866 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z

References

Link	Providers
https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682
https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113
https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045
https://lore.kernel.org/linux-cve-announce/2024051939-CVE-2024-35866-97e5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-35866
https://www.cve.org/CVERecord?id=CVE-2024-35866

History

Wed, 13 Nov 2024 02:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-19T08:34:24.877Z

Updated: 2024-11-05T09:24:00.994Z

Reserved: 2024-05-17T13:50:33.107Z

Link: CVE-2024-35866

Vulnrichment

Updated: 2024-08-02T03:21:48.419Z

NVD

Status : Awaiting Analysis

Published: 2024-05-19T09:15:08.123

Modified: 2024-05-20T13:00:04.957

Link: CVE-2024-35866

Redhat

Severity : Low

Publid Date: 2024-05-19T00:00:00Z

Links: CVE-2024-35866 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35866", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.107Z", "datePublished": "2024-05-19T08:34:24.877Z", "dateUpdated": "2024-11-05T09:24:00.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:24:00.994Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_dump_full_key()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/ioctl.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "10e17ca4000e", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "3103163ccd3b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "58acd1f49716", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/ioctl.c"], "versions": [{"version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682"}, {"url": "https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113"}, {"url": "https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045"}], "title": "smb: client: fix potential UAF in cifs_dump_full_key()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T15:14:23.692750Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:30.976Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.419Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.419Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T15:14:23.692750Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.967Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "smb: client: fix potential UAF in cifs_dump_full_key()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "10e17ca4000e", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "3103163ccd3b", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "58acd1f49716", "versionType": "git"}], "programFiles": ["fs/smb/client/ioctl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "6.6.26", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "custom", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/ioctl.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/10e17ca4000ec34737bde002a13435c38ace2682"}, {"url": "https://git.kernel.org/stable/c/3103163ccd3be4adcfa37e15608fb497be044113"}, {"url": "https://git.kernel.org/stable/c/58acd1f497162e7d282077f816faa519487be045"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_dump_full_key()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:30:22.483Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35866", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:21:48.419Z", "dateReserved": "2024-05-17T13:50:33.107Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T08:34:24.877Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: smb: client: fix potential UAF in cifs_dump_full_key()", "id": "2281760", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281760"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix potential UAF in cifs_dump_full_key()\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.", "A use-after-free flaw was found in the Linux kernel in the smb client cifs_dump_full_key() when exiting a session. This flaw allows a local attacker to crash the system."], "name": "CVE-2024-35866", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35866\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35866\nhttps://lore.kernel.org/linux-cve-announce/2024051939-CVE-2024-35866-97e5@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 6.6.26, kernel 6.8.5, kernel 6.9"}