{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-35863", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.107Z", "datePublished": "2024-05-19T08:34:22.114Z", "dateUpdated": "2026-08-05T11:30:27.234Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:27.234Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in is_valid_oplock_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable walk is executed by the cifs demultiplex kernel thread directly on an unsolicited SMB1 LOCKING_ANDX frame read off the TCP/445 socket, so it is driven entirely by data from a remote SMB peer. A malicious/compromised file server, or an off-path/MITM injector on the unsigned SMB1 stream, reaches it over the network.\nAC:L - The attacker controls both sides of the race: it can force repeated session teardowns (DFS referrals/failover, forced reconnects, multiuser tlink expiry) and can hold the SES_EXITING window open arbitrarily long by stalling the blocking SMB LOGOFF reply that `__cifs_put_smb_ses()` waits on before unlinking and freeing the session, while flooding oplock-break frames. Attempts are unlimited and require no condition outside the attacker's influence.\nPR:N - No credentials or privileges on the victim client are needed — the oplock-break frame is dispatched with no UID/session lookup and no signature validation, so any peer able to put bytes on the client's SMB connection triggers the walk. The attacking entity is the server side of an existing mount, which holds no privilege on the vulnerable system.\nUI:N - Exploitation only requires an already-established SMB1 mount, which in practice is persistent (fstab/autofs/systemd, embedded and industrial NAS deployments); a compromised or malicious server then attacks at a time of its choosing with no action by any local user.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority as the vulnerable code. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free on `cifs_ses`/`cifs_tcon` structures lets the attacker reclaim the freed slab object with controlled content and have the kernel dereference and act on it, yielding a kernel-memory disclosure primitive. Session objects also hold credential material (auth keys, passwords), making leakage of highly sensitive data plausible.\nI:H - The UAF permits heap grooming so that attacker-shaped data occupies the freed session/tcon memory that is then written through and used for list and file-handle operations, giving a write/control-flow-hijack primitive. Per kernel CVSS guidance, memory corruption exploitable this way is scored High.\nA:H - Dereferencing freed session/tcon memory in the cifs demultiplex kernel thread readily produces an oops or panic, and the attacker can repeat it at will. Any kernel crash is High availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/misc.c" ], "versions": [ { "version": "7f48558e6489d032b1584b0cc9ac4bb11072c034", "lessThan": "494c91e1e9413b407d12166a61b84200d4d54fac", "status": "affected", "versionType": "git" }, { "version": "7f48558e6489d032b1584b0cc9ac4bb11072c034", "lessThan": "0a15ba88a32fa7a516aff7ffd27befed5334dff2", "status": "affected", "versionType": "git" }, { "version": "7f48558e6489d032b1584b0cc9ac4bb11072c034", "lessThan": "16d58c6a7db5050b9638669084b63fc05f951825", "status": "affected", "versionType": "git" }, { "version": "7f48558e6489d032b1584b0cc9ac4bb11072c034", "lessThan": "69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29", "status": "affected", "versionType": "git" }, { "version": "a67172a013953664b1dad03c648200c70b90506c", "status": "affected", "versionType": "git" }, { "version": "3.12.48", "lessThan": "3.13", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/misc.c" ], "versions": [ { "version": "3.13", "status": "affected" }, { "version": "0", "lessThan": "3.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.85", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.1.85" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.6.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.8.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13", "versionEndExcluding": "6.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.48" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/494c91e1e9413b407d12166a61b84200d4d54fac" }, { "url": "https://git.kernel.org/stable/c/0a15ba88a32fa7a516aff7ffd27befed5334dff2" }, { "url": "https://git.kernel.org/stable/c/16d58c6a7db5050b9638669084b63fc05f951825" }, { "url": "https://git.kernel.org/stable/c/69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29" } ], "title": "smb: client: fix potential UAF in is_valid_oplock_break()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.533Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/494c91e1e9413b407d12166a61b84200d4d54fac", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0a15ba88a32fa7a516aff7ffd27befed5334dff2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/16d58c6a7db5050b9638669084b63fc05f951825", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/69ccf040acddf33a3a85ec0f6b45ef84b0f7ec29", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-35863", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:41:24.364295Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:16.978Z" } } ] } }