CVE-2024-46796 — Use After Free in Linux

CWE-416 — Use After Free6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 93.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
LinuxLinux KernelDebian Linux+4 more
Timeline
PublishedSep 18

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch run fstests generic/013 …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

▶NVDlinux/linux_kernel6.6.32 — 6.6.51+2
▶Debianlinux/linux_kernel< 6.10.11-1+1
▶CVEListV5linux/linux1e60bc0e954389af82f1d9a85f13a63f6572350f — 5a72d1edb0843e4c927a4096f81e631031c25c28+3

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2024-46796: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op(↗2024-09-18
▶
GHSA
GHSA-m8jr-w275-x227: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_o↗2024-09-18
▶

📋Vendor Advisories

3
Red Hat
kernel: smb: client: fix double put of @cfile in smb2_set_path_size()↗2024-09-18
▶
Microsoft
smb: client: fix double put of @cfile in smb2_set_path_size()↗2024-09-10
▶
Debian
CVE-2024-46796: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client...↗2024
▶
CVE-2024-46796 — Use After Free in Linux | cvebase