CVE-2024-35999 (GCVE-0-2024-35999)
Vulnerability from cvelistv5
Published
2024-05-20 09:48
Modified
2026-08-05 11:31
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb3: missing lock when picking channel Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index. Addresses-Coverity: 1582039 ("Data race condition (MISSING_LOCK)")
References
Impacted products
Vendor Product Version
Linux Linux Version: 724244cdb3828522109c88e56a0242537aefabe9
Version: 724244cdb3828522109c88e56a0242537aefabe9
Version: 724244cdb3828522109c88e56a0242537aefabe9
Version: 724244cdb3828522109c88e56a0242537aefabe9
Version: 3d74c2c917e4006a3bd660d2fc7829cb2ef64113
Version: 5.15.27   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:47:15.980890Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T20:01:44.554Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:13.189Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98c7ed29cd754ae7475dc7cb3f33399fda902729",
              "status": "affected",
              "version": "724244cdb3828522109c88e56a0242537aefabe9",
              "versionType": "git"
            },
            {
              "lessThan": "0fcf7e219448e937681216353c9a58abae6d3c2e",
              "status": "affected",
              "version": "724244cdb3828522109c88e56a0242537aefabe9",
              "versionType": "git"
            },
            {
              "lessThan": "60ab245292280905603bc0d3654f4cf8fceccb00",
              "status": "affected",
              "version": "724244cdb3828522109c88e56a0242537aefabe9",
              "versionType": "git"
            },
            {
              "lessThan": "8094a600245e9b28eb36a13036f202ad67c1f887",
              "status": "affected",
              "version": "724244cdb3828522109c88e56a0242537aefabe9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3d74c2c917e4006a3bd660d2fc7829cb2ef64113",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.27",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: missing lock when picking channel\n\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\n\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is driven by the remote SMB server over TCP/445 \u2014 channel invalidation happens in `cifs_chan_skip_or_disable()` and `cifs_decrease_secondary_channels()`, both reached from responses the server controls (dropping `SMB2_GLOBAL_CAP_MULTI_CHANNEL` on reconnect, changing the advertised interface list, or resetting a channel\u0027s connection). A malicious or compromised server, or an on-path attacker, can force channel teardown at will against a client with a multichannel mount.\nAC:L - The remote peer deterministically and repeatedly controls one side of the race by tearing down or re-advertising channels, while ongoing background I/O and writeback continuously call `cifs_pick_channel()` for the other side; the server can even force client requests via oplock/lease breaks. No unpredictable memory layout or victim state is required, and SMB3 multichannel is a widely deployed mount option rather than a rare config.\nPR:N - The attacker is the remote SMB peer or an on-path attacker and needs no account, credentials, or privileges on the victim client; the defect is hit during ordinary operation of an already-established session.\nUI:N - The multichannel CIFS mount is a pre-existing environmental condition (fstab/autofs/Azure Files), and at exploit time no deliberate victim action is needed \u2014 background writeback, echoes, and cached-dir refreshes reach `cifs_pick_channel()` on their own.\nS:U - The unsynchronized read and its effects are confined to the client kernel\u0027s own CIFS session and `TCP_Server_Info` structures within a single security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:N - `ses-\u003echans[]` is a fixed-size in-struct array and `index` is bounded by `chan_count \u003c= CIFS_MAX_CHANNELS`, so the racy load reads no out-of-bounds memory and yields no read primitive; the observable value is a NULL or unvalidated channel pointer, not disclosed kernel data.\nI:N - Nothing is written out of bounds and no file data or kernel object is modified \u2014 the defect only causes the wrong (or NULL) channel to be selected, and SMB signing/encryption still governs what is actually transmitted.\nA:H - The returned channel was never validated, so it can be NULL \u2014 propagating `-EIO`/`-ECONNABORTED` failures out of reads, writes, flushes and writeback across the whole mount \u2014 or a channel already marked `terminate`/`NEEDS_RECONNECT`, in which case requests are submitted on a dying connection and block until reconnect or timeout, wedging the mount. The remote server can retrigger this indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:30.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00"
        },
        {
          "url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887"
        }
      ],
      "title": "smb3: missing lock when picking channel",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35999",
    "datePublished": "2024-05-20T09:48:01.653Z",
    "dateReserved": "2024-05-17T13:50:33.149Z",
    "dateUpdated": "2026-08-05T11:31:30.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:13.189Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35999\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:47:15.980890Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:47:20.207Z\"}}], \"cna\": {\"title\": \"smb3: missing lock when picking channel\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The race is driven by the remote SMB server over TCP/445 \\u2014 channel invalidation happens in `cifs_chan_skip_or_disable()` and `cifs_decrease_secondary_channels()`, both reached from responses the server controls (dropping `SMB2_GLOBAL_CAP_MULTI_CHANNEL` on reconnect, changing the advertised interface list, or resetting a channel\u0027s connection). A malicious or compromised server, or an on-path attacker, can force channel teardown at will against a client with a multichannel mount.\\nAC:L - The remote peer deterministically and repeatedly controls one side of the race by tearing down or re-advertising channels, while ongoing background I/O and writeback continuously call `cifs_pick_channel()` for the other side; the server can even force client requests via oplock/lease breaks. No unpredictable memory layout or victim state is required, and SMB3 multichannel is a widely deployed mount option rather than a rare config.\\nPR:N - The attacker is the remote SMB peer or an on-path attacker and needs no account, credentials, or privileges on the victim client; the defect is hit during ordinary operation of an already-established session.\\nUI:N - The multichannel CIFS mount is a pre-existing environmental condition (fstab/autofs/Azure Files), and at exploit time no deliberate victim action is needed \\u2014 background writeback, echoes, and cached-dir refreshes reach `cifs_pick_channel()` on their own.\\nS:U - The unsynchronized read and its effects are confined to the client kernel\u0027s own CIFS session and `TCP_Server_Info` structures within a single security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\\nC:N - `ses-\u003echans[]` is a fixed-size in-struct array and `index` is bounded by `chan_count \u003c= CIFS_MAX_CHANNELS`, so the racy load reads no out-of-bounds memory and yields no read primitive; the observable value is a NULL or unvalidated channel pointer, not disclosed kernel data.\\nI:N - Nothing is written out of bounds and no file data or kernel object is modified \\u2014 the defect only causes the wrong (or NULL) channel to be selected, and SMB signing/encryption still governs what is actually transmitted.\\nA:H - The returned channel was never validated, so it can be NULL \\u2014 propagating `-EIO`/`-ECONNABORTED` failures out of reads, writes, flushes and writeback across the whole mount \\u2014 or a channel already marked `terminate`/`NEEDS_RECONNECT`, in which case requests are submitted on a dying connection and block until reconnect or timeout, wedging the mount. The remote server can retrigger this indefinitely.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"724244cdb3828522109c88e56a0242537aefabe9\", \"lessThan\": \"98c7ed29cd754ae7475dc7cb3f33399fda902729\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"724244cdb3828522109c88e56a0242537aefabe9\", \"lessThan\": \"0fcf7e219448e937681216353c9a58abae6d3c2e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"724244cdb3828522109c88e56a0242537aefabe9\", \"lessThan\": \"60ab245292280905603bc0d3654f4cf8fceccb00\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"724244cdb3828522109c88e56a0242537aefabe9\", \"lessThan\": \"8094a600245e9b28eb36a13036f202ad67c1f887\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3d74c2c917e4006a3bd660d2fc7829cb2ef64113\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.27\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/smb/client/transport.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.30\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/transport.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729\"}, {\"url\": \"https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e\"}, {\"url\": \"https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00\"}, {\"url\": \"https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb3: missing lock when picking channel\\n\\nCoverity spotted a place where we should have been holding the\\nchannel lock when accessing the ses channel index.\\n\\nAddresses-Coverity: 1582039 (\\\"Data race condition (MISSING_LOCK)\\\")\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.30\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.15.27\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:30.660Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35999\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:30.660Z\", \"dateReserved\": \"2024-05-17T13:50:33.149Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:48:01.653Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.