CVE-2024-53179

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-53179", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.008Z", "datePublished": "2024-12-27T13:49:22.982Z", "dateUpdated": "2026-10-30T12:20:09.698Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:20:09.698Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A task B\ncifs_mount()\n dfs_mount_share()\n get_session()\n cifs_mount_get_session() cifs_send_recv()\n cifs_get_smb_ses() compound_send_recv()\n cifs_setup_session() smb2_setup_request()\n kfree_sensitive() smb2_calc_signature()\n crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses->auth_key.response by\nchecking whether @ses->ses_status is SES_GOOD or SES_EXITING with\n@ses->ses_lock held. After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call ->logoff() only\nwhen @ses was known to be good (e.g. valid ->auth_key.response), so\nit's safe to access signing key when @ses->ses_status == SES_EXITING."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable `smb2_calc_signature()` runs in the cifs demultiplex thread on every inbound signed SMB2/2.1 response (`smb2_check_receive` \u2192 `smb2_verify_signature`), while the freeing side (`cifs_setup_session()`) is entered on reconnect or DFS re-referral \u2014 both driven by the remote SMB server dropping the TCP connection or serving referrals. A malicious, compromised, or spoofed server (or an on-path attacker injecting RSTs) controls both halves of the race purely over the network.\nAC:L - The attacker owns both sides of the race and the window is server-timed: after the free, `auth_key.response` stays NULL across the entire multi-round-trip NTLMSSP handshake, whose latency the server dictates, while `SMB2_IOCTL`/`SMB2_TREE_CONNECT` deliberately bypass the reconnect serialization in `smb2_reconnect()` and go straight to signing. Triggering is repeatable and reliable, not dependent on any condition outside attacker control.\nPR:N - No credentials on the client are needed \u2014 the demultiplex/signing path performs no capability or permission check, and the remote peer needs no authentication to tear down the TCP connection or drive session re-setup on an existing mount. The attacker is the network peer, not a local user.\nUI:N - Against an already-established SMB2.1 signed mount the attacker forces reconnects and session re-setup at will; no administrator or user action is required at exploitation time. Concurrent requests are supplied by ordinary background client activity (echo, DFS referral, oplock traffic).\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed heap object is read and consumed as the HMAC-SHA256 signing key, and the resulting signature is transmitted back to the attacker, forming an oracle over reallocated kernel heap contents. The attacker additionally controls the object's kmalloc size class via the server-supplied NTLMSSP `TargetInfoArray.Length`, making the UAF read a groomable arbitrary-disclosure primitive.\nI:H - Because the attacker selects the slab and can refill the freed 16 bytes, the client can be made to sign SMB traffic with a key the attacker knows, destroying the integrity guarantee of SMB signing and enabling forged/modified filesystem traffic. As a use-after-free it also carries the standard heap-corruption path to control-flow hijack.\nA:H - Once `auth_key.response` is NULLed, `crypto_shash_setkey(tfm, NULL, 16)` dereferences NULL and oopses the kernel; on the send path this occurs while `server->srv_mutex` is held, permanently wedging all further I/O on that mount. Customers reported this as a production crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2proto.h", "fs/smb/client/smb2transport.c"], "versions": [{"version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "0944c2596c2a3442735b5bb6714a17a16188a68f", "status": "affected", "versionType": "git"}, {"version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "39619c65ab4bbb3e78c818f537687653e112764d", "status": "affected", "versionType": "git"}, {"version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591", "status": "affected", "versionType": "git"}, {"version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "343d7fe6df9e247671440a932b6a73af4fa86d95", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2proto.h", "fs/smb/client/smb2transport.c"], "versions": [{"version": "3.12", "status": "affected"}, {"version": "0", "lessThan": "3.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.70", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.6.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0944c2596c2a3442735b5bb6714a17a16188a68f"}, {"url": "https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d"}, {"url": "https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591"}, {"url": "https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95"}], "title": "smb: client: fix use-after-free of signing key", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-53179", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-10T17:13:09.010478Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T17:21:09.328Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-53179", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-10T17:13:09.010478Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T17:13:10.325Z"}}], "cna": {"title": "smb: client: fix use-after-free of signing key", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable `smb2_calc_signature()` runs in the cifs demultiplex thread on every inbound signed SMB2/2.1 response (`smb2_check_receive` \u2192 `smb2_verify_signature`), while the freeing side (`cifs_setup_session()`) is entered on reconnect or DFS re-referral \u2014 both driven by the remote SMB server dropping the TCP connection or serving referrals. A malicious, compromised, or spoofed server (or an on-path attacker injecting RSTs) controls both halves of the race purely over the network.\nAC:L - The attacker owns both sides of the race and the window is server-timed: after the free, `auth_key.response` stays NULL across the entire multi-round-trip NTLMSSP handshake, whose latency the server dictates, while `SMB2_IOCTL`/`SMB2_TREE_CONNECT` deliberately bypass the reconnect serialization in `smb2_reconnect()` and go straight to signing. Triggering is repeatable and reliable, not dependent on any condition outside attacker control.\nPR:N - No credentials on the client are needed \u2014 the demultiplex/signing path performs no capability or permission check, and the remote peer needs no authentication to tear down the TCP connection or drive session re-setup on an existing mount. The attacker is the network peer, not a local user.\nUI:N - Against an already-established SMB2.1 signed mount the attacker forces reconnects and session re-setup at will; no administrator or user action is required at exploitation time. Concurrent requests are supplied by ordinary background client activity (echo, DFS referral, oplock traffic).\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed heap object is read and consumed as the HMAC-SHA256 signing key, and the resulting signature is transmitted back to the attacker, forming an oracle over reallocated kernel heap contents. The attacker additionally controls the object's kmalloc size class via the server-supplied NTLMSSP `TargetInfoArray.Length`, making the UAF read a groomable arbitrary-disclosure primitive.\nI:H - Because the attacker selects the slab and can refill the freed 16 bytes, the client can be made to sign SMB traffic with a key the attacker knows, destroying the integrity guarantee of SMB signing and enabling forged/modified filesystem traffic. As a use-after-free it also carries the standard heap-corruption path to control-flow hijack.\nA:H - Once `auth_key.response` is NULLed, `crypto_shash_setkey(tfm, NULL, 16)` dereferences NULL and oopses the kernel; on the send path this occurs while `server->srv_mutex` is held, permanently wedging all further I/O on that mount. Customers reported this as a production crash."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "0944c2596c2a3442735b5bb6714a17a16188a68f", "versionType": "git"}, {"status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "39619c65ab4bbb3e78c818f537687653e112764d", "versionType": "git"}, {"status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591", "versionType": "git"}, {"status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "lessThan": "343d7fe6df9e247671440a932b6a73af4fa86d95", "versionType": "git"}], "programFiles": ["fs/smb/client/smb2proto.h", "fs/smb/client/smb2transport.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"status": "unaffected", "version": "0", "lessThan": "3.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.70", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.2", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/smb2proto.h", "fs/smb/client/smb2transport.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0944c2596c2a3442735b5bb6714a17a16188a68f"}, {"url": "https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d"}, {"url": "https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591"}, {"url": "https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A task B\ncifs_mount()\n dfs_mount_share()\n get_session()\n cifs_mount_get_session() cifs_send_recv()\n cifs_get_smb_ses() compound_send_recv()\n cifs_setup_session() smb2_setup_request()\n kfree_sensitive() smb2_calc_signature()\n crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses->auth_key.response by\nchecking whether @ses->ses_status is SES_GOOD or SES_EXITING with\n@ses->ses_lock held. After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call ->logoff() only\nwhen @ses was known to be good (e.g. valid ->auth_key.response), so\nit's safe to access signing key when @ses->ses_status == SES_EXITING."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.70", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.2", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "3.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:20:09.698Z"}}}, "cveMetadata": {"cveId": "CVE-2024-53179", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:20:09.698Z", "dateReserved": "2024-11-19T17:17:25.008Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-27T13:49:22.982Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2proto.h", "fs/smb/client/smb2transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0944c2596c2a3442735b5bb6714a17a16188a68f", "status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "versionType": "git"}, {"lessThan": "39619c65ab4bbb3e78c818f537687653e112764d", "status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "versionType": "git"}, {"lessThan": "0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591", "status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "versionType": "git"}, {"lessThan": "343d7fe6df9e247671440a932b6a73af4fa86d95", "status": "affected", "version": "32811d242ff6f28da2ab18c90a15e32fd958e774", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2proto.h", "fs/smb/client/smb2transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"lessThan": "3.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.70", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5CDA440-0233-41C3-A5AE-5DE4FD068A1D", "versionEndExcluding": "6.6.70", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C535878-0221-4BBF-824E-700AF4DD09BF", "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A task B\ncifs_mount()\n dfs_mount_share()\n get_session()\n cifs_mount_get_session() cifs_send_recv()\n cifs_get_smb_ses() compound_send_recv()\n cifs_setup_session() smb2_setup_request()\n kfree_sensitive() smb2_calc_signature()\n crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses->auth_key.response by\nchecking whether @ses->ses_status is SES_GOOD or SES_EXITING with\n@ses->ses_lock held. After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call ->logoff() only\nwhen @ses was known to be good (e.g. valid ->auth_key.response), so\nit's safe to access signing key when @ses->ses_status == SES_EXITING."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: se corrige el use-after-free de la clave de firma Los clientes han informado sobre el use-after-free en @ses->auth_key.response con SMB2.1 + montajes de firma que se producen debido a la siguiente ejecuci\u00f3n: tarea A tarea B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() Compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Solucione esto asegur\u00e1ndose de que tenemos un @ses->auth_key.response v\u00e1lido comprobando si @ses->ses_status es SES_GOOD o SES_EXITING con @ses->ses_lock Despu\u00e9s de el commit 24a9799aa8ef (\"smb: cliente: corregir UAF en smb2_reconnect_server()\"), nos aseguramos de llamar a ->logoff() solo cuando se sab\u00eda que @ses era correcto (por ejemplo, ->auth_key.response v\u00e1lido), por lo que es seguro acceder a la clave de firma cuando @ses->ses_status == SES_EXITING."}], "id": "CVE-2024-53179", "lastModified": "2026-10-30T13:17:44.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-53179", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-10T17:13:09.010478Z", "version": "2.0.3"}}]}, "published": "2024-12-27T14:15:25.307", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0944c2596c2a3442735b5bb6714a17a16188a68f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: smb: client: fix use-after-free of signing key", "id": "2334401", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334401"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix use-after-free of signing key\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\ntask A task B\ncifs_mount()\ndfs_mount_share()\nget_session()\ncifs_mount_get_session() cifs_send_recv()\ncifs_get_smb_ses() compound_send_recv()\ncifs_setup_session() smb2_setup_request()\nkfree_sensitive() smb2_calc_signature()\ncrypto_shash_setkey() *UAF*\nFix this by ensuring that we have a valid @ses->auth_key.response by\nchecking whether @ses->ses_status is SES_GOOD or SES_EXITING with\n@ses->ses_lock held. After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call ->logoff() only\nwhen @ses was known to be good (e.g. valid ->auth_key.response), so\nit's safe to access signing key when @ses->ses_status == SES_EXITING."], "name": "CVE-2024-53179", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-53179\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-53179\nhttps://lore.kernel.org/linux-cve-announce/2024122719-CVE-2024-53179-2179@gregkh/T"], "threat_severity": "Moderate"}

{}