{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50285", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.984Z", "datePublished": "2024-11-19T01:30:28.603Z", "dateUpdated": "2026-08-05T11:43:04.731Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:04.731Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: check outstanding simultaneous SMB operations\n\nIf Client send simultaneous SMB operations to ksmbd, It exhausts too much\nmemory through the \"ksmbd_work_cache”. It will cause OOM issue.\nksmbd has a credit mechanism but it can't handle this problem. This patch\nadd the check if it exceeds max credits to prevent this problem by assuming\nthat one smb request consumes at least one credit." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is the in-kernel SMB server; the vulnerable allocation is driven directly by PDUs read off the TCP/445 socket in `ksmbd_conn_handler_loop()`. Any remote host with network reachability to the server triggers it.\nAC:L - The attacker simply pipelines SMB PDUs faster than the workqueue drains them, optionally stalling workers by not draining its own socket; there is no race to win and no memory layout to control. Success is deterministic and repeatable.\nPR:N - The allocation in `queue_ksmbd_work()` happens before any negotiate, session setup, or authentication — the only gate is `ksmbd_smb_request()`, which checks the protocol magic bytes alone. An entirely unauthenticated attacker reaches it on connect.\nUI:N - The attacker initiates the TCP connection and sends the request flood unaided; no action by any local user or administrator is required.\nS:U - Memory exhaustion occurs within the kernel's own security authority on the ksmbd server host, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The flaw is unbounded allocation of `ksmbd_work` objects and request buffers; no attacker-controlled read, out-of-bounds access, or uninitialized data is exposed, and the fix adds only a counter check.\nI:N - No memory corruption, out-of-bounds write, or type confusion is involved — the queued objects are correctly allocated and freed, just in unbounded quantity, so no data is modified.\nA:H - An unauthenticated client can exhaust kernel memory through `ksmbd_work_cache` plus attacker-sized request buffers, driving the system into OOM as stated in the commit message, killing processes and rendering the host unusable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/server.c", "fs/smb/server/smb_common.c", "fs/smb/server/smb_common.h" ], "versions": [ { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "1f993777275cbd8f74765c4f9d9285cb907c9be5", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "e257ac6fe138623cf59fca8898abdf659dbc8356", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "0a77d947f599b1f39065015bec99390d0c0022ee", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/server.c", "fs/smb/server/smb_common.c", "fs/smb/server/smb_common.h" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.61", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.8", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.11.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1f993777275cbd8f74765c4f9d9285cb907c9be5" }, { "url": "https://git.kernel.org/stable/c/e257ac6fe138623cf59fca8898abdf659dbc8356" }, { "url": "https://git.kernel.org/stable/c/0a77d947f599b1f39065015bec99390d0c0022ee" } ], "title": "ksmbd: check outstanding simultaneous SMB operations", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50285", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:14:33.951916Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:21.944Z" } } ] } }