CVE-2024-35999 smb3: missing lock when picking channel
A missing lock in the Linux kernel SMB3 implementation allows a race condition when selecting channels, potentially leading to undefined behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35999?
CVE-2024-35999 is a high-severity vulnerability in Linux kernel, published on 20 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb3: missing lock when picking channel
Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index.
Addresses-Coverity: 1582039 ("Data race condition (MISSING_LOCK)")
Weakness: CWE-667
Which versions are affected by CVE-2024-35999?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35999?
Apply the vendor's patch.
Is CVE-2024-35999 being exploited?
There is no known exploitation of CVE-2024-35999 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-59474, BELL-CVE-2024-35999, DEBIAN-CVE-2024-35999, GHSA-v8pp-r8hm-gfqw, ROOT-OS-DEBIAN-11-CVE-2024-35999, ROOT-OS-UBUNTU-2204-CVE-2024-35999 and 1 more.