CVE-2024-35869 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Linux	Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a
https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc
https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79
https://lore.kernel.org/linux-cve-announce/2024051940-CVE-2024-35869-73f8@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-35869
https://www.cve.org/CVERecord?id=CVE-2024-35869

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-19T08:34:27.645Z

Updated: 2024-08-02T03:21:48.968Z

Reserved: 2024-05-17T13:50:33.108Z

Link: CVE-2024-35869

Vulnrichment

Updated: 2024-05-24T15:08:25.313Z

NVD

Status : Awaiting Analysis

Published: 2024-05-19T09:15:08.340

Modified: 2024-07-03T02:02:21.027

Link: CVE-2024-35869

Redhat

Severity : Moderate

Publid Date: 2024-05-19T00:00:00Z

Links: CVE-2024-35869 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35869", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.108Z", "datePublished": "2024-05-19T08:34:27.645Z", "dateUpdated": "2024-08-02T03:21:48.968Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:30:25.658Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: guarantee refcounted children from parent session\n\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon->ses are also refcounted. They're all needed across\nthe entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at\nit, too."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "645f332c6b63", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "e1db9ae87b71", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "062a7f0ff46e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "versions": [{"version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"}], "title": "smb: client: guarantee refcounted children from parent session", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-24T15:01:40.323674Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "645f332c6b63 ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "e1db9ae87b71 ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "062a7f0ff46e ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.6.29", "versionType": "custom", "lessThanOrEqual": "6.6.*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": " 6.8.5", "versionType": "custom", "lessThanOrEqual": "6.8.* "}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.9"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:33:52.595Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.968Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35869", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.108Z", "datePublished": "2024-05-19T08:34:27.645Z", "dateUpdated": "2024-06-04T17:33:52.595Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:30:25.658Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: guarantee refcounted children from parent session\n\nAvoid potential use-after-free bugs when walking DFS referrals,\nmounting and performing DFS failover by ensuring that all children\nfrom parent @tcon->ses are also refcounted. They're all needed across\nthe entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at\nit, too."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "645f332c6b63", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "e1db9ae87b71", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "062a7f0ff46e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsglob.h", "fs/smb/client/cifsproto.h", "fs/smb/client/connect.c", "fs/smb/client/dfs.c", "fs/smb/client/dfs.h", "fs/smb/client/dfs_cache.c", "fs/smb/client/misc.c"], "versions": [{"version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/645f332c6b63499cc76197f9b6bffcc659ba64cc"}, {"url": "https://git.kernel.org/stable/c/e1db9ae87b7148c021daee1fcc4bc71b2ac58a79"}, {"url": "https://git.kernel.org/stable/c/062a7f0ff46eb57aff526897bd2bebfdb1d3046a"}], "title": "smb: client: guarantee refcounted children from parent session", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-24T15:01:40.323674Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "645f332c6b63 ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "e1db9ae87b71 ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "062a7f0ff46e ", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.6.29", "versionType": "custom", "lessThanOrEqual": "6.6.*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": " 6.8.5", "versionType": "custom", "lessThanOrEqual": "6.8.* "}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.9"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-24T15:08:25.313Z"}, "title": "CISA ADP Vulnrichment"}]}}