CVE-2024-53179 smb: client: fix use-after-free of signing key
A use-after-free in the Linux kernel SMB client allows attackers to cause denial of service or execute code via race conditions during SMB2.1 signed mounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53179?
CVE-2024-53179 is a critical use after free vulnerability in Linux kernel, published on 27 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free of signing key
Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race:
task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF*
Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.
Weakness: CWE-416
Which versions are affected by CVE-2024-53179?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53179?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-53179 being exploited?
There is no known exploitation of CVE-2024-53179 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-55573, BELL-CVE-2024-53179, DEBIAN-CVE-2024-53179, GHSA-2qfq-q4fv-fp24, ROOT-OS-DEBIAN-11-CVE-2024-53179, ROOT-OS-DEBIAN-12-CVE-2024-53179 and 2 more.