cbcvebase.
CVE-2024-35866
published 2024-05-19

CVE-2024-35866: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key() Skip sessions that are being teared…

PriorityP335high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
14.5th percentile
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

Affected

20 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
debianlinux-6.1< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
linuxlinux
linuxlinux>= 1bb56810677f26b78d57a3038054943efd334a1c < d798fd98e3563027c5162259ead517057d6fa794d798fd98e3563027c5162259ead517057d6fa794
linuxlinux>= 1bb56810677f26b78d57a3038054943efd334a1c < f4a60d360d9114b5085701a3702a0102b0d6d846f4a60d360d9114b5085701a3702a0102b0d6d846
linuxlinux>= 1bb56810677f26b78d57a3038054943efd334a1c < 10e17ca4000ec34737bde002a13435c38ace268210e17ca4000ec34737bde002a13435c38ace2682
linuxlinux>= 1bb56810677f26b78d57a3038054943efd334a1c < 3103163ccd3be4adcfa37e15608fb497be0441133103163ccd3be4adcfa37e15608fb497be044113
linuxlinux>= 1bb56810677f26b78d57a3038054943efd334a1c < 58acd1f497162e7d282077f816faa519487be04558acd1f497162e7d282077f816faa519487be045
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.133-16.1.133-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 5.15.0-144.1575.15.0-144.157
linuxlinux_kernel>= 0 < 6.8.0-38.386.8.0-38.38
linuxlinux_kernel>= 5.13 < 5.15.1815.15.181
linuxlinux_kernel>= 5.16 < 6.1.1326.1.132
linuxlinux_kernel>= 6.2 < 6.6.266.6.26
linuxlinux_kernel>= 6.7 < 6.8.56.8.5
msrccbl2_kernel_5.15.182.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_msrc6.6MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.