CVE-2024-49988 (GCVE-0-2024-49988)
Vulnerability from cvelistv5
Published
2024-10-21 18:02
Modified
2026-08-05 11:40
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add refcnt to ksmbd_conn struct When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49988",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:31:36.656509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:43.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c",
            "fs/smb/server/connection.h",
            "fs/smb/server/oplock.c",
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "18f06bacc197d4ac9b518ad1c69999bc3d83e7aa",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "e9dac92f4482a382e8c0fe1bc243da5fc3526b0c",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c",
            "fs/smb/server/connection.h",
            "fs/smb/server/oplock.c",
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add refcnt to ksmbd_conn struct\n\nWhen sending an oplock break request, opinfo-\u003econn is used,\nBut freed -\u003econn can be used on multichannel.\nThis patch add a reference count to the ksmbd_conn struct\nso that it can be freed when it is no longer used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the in-kernel SMB server (fs/smb/server/), driven entirely by SMB2/3 traffic on TCP/445 \u2014 the attacker triggers it by opening connections, binding a second channel, dropping the first, and issuing CREATE/WRITE requests that force an oplock/lease break. No local access is needed.\nAC:L - The attacker controls both sides of the sequence: they create the oplock/lease, they establish and tear down the channel that frees the ksmbd_conn, and they choose when to trigger the break that dereferences the stale pointer, so it is repeatable at will and can be retried indefinitely across connections. Heap grooming to reclaim the freed conn is done with attacker-sent SMB buffers, and the config-independent r_count/RELEASING TOCTOU offers an additional path.\nPR:L - An authenticated SMB session is required \u2014 oplocks/leases are only created after session setup and tree connect, and multichannel binding is explicitly refused for guest users (user_guest() \u2192 -EOPNOTSUPP), so valid credentials are needed. No administrative or share-admin privileges are required beyond ordinary file access on an exported share.\nUI:N - The attacker performs every step from its own SMB connections \u2014 open with a batch oplock/lease, bind a channel, disconnect it, then re-open or write the file to force the break. No action by an administrator or another user is required.\nS:U - The use-after-free corrupts kernel heap memory belonging to the ksmbd server and is exploited within the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed struct ksmbd_conn is read back in multiple paths (compare_guid_key reads conn-\u003eClientGUID, ksmbd_conn_write follows conn-\u003etransport-\u003eops), so reclaiming the slab object with attacker-shaped data turns these into a kernel-memory read/disclosure primitive, and break notifications built from the stale conn can leak kernel data to the wire.\nI:H - The same dangling pointer is written through \u2014 atomic_inc/dec on conn-\u003er_count, mutex_lock(\u0026conn-\u003esrv_mutex), and wake_up(\u0026conn-\u003er_count_q) traversing a freed waitqueue \u2014 and conn-\u003etransport-\u003eops-\u003ewritev is called indirectly, giving controlled-write and control-flow-hijack potential for full kernel compromise.\nA:H - Dereferencing and writing to the freed ksmbd_conn reliably corrupts the slab and oopses or panics the kernel (mutex/waitqueue operations on freed memory, indirect call through a stale transport pointer), taking down the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:55.820Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/18f06bacc197d4ac9b518ad1c69999bc3d83e7aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9dac92f4482a382e8c0fe1bc243da5fc3526b0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27"
        }
      ],
      "title": "ksmbd: add refcnt to ksmbd_conn struct",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49988",
    "datePublished": "2024-10-21T18:02:31.845Z",
    "dateReserved": "2024-10-21T12:17:06.054Z",
    "dateUpdated": "2026-08-05T11:40:55.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49988\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:31:36.656509Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:31:39.876Z\"}}], \"cna\": {\"title\": \"ksmbd: add refcnt to ksmbd_conn struct\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"18f06bacc197d4ac9b518ad1c69999bc3d83e7aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"e9dac92f4482a382e8c0fe1bc243da5fc3526b0c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"ee426bfb9d09b29987369b897fe9b6485ac2be27\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/server/connection.c\", \"fs/smb/server/connection.h\", \"fs/smb/server/oplock.c\", \"fs/smb/server/vfs_cache.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/server/connection.c\", \"fs/smb/server/connection.h\", \"fs/smb/server/oplock.c\", \"fs/smb/server/vfs_cache.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/18f06bacc197d4ac9b518ad1c69999bc3d83e7aa\"}, {\"url\": \"https://git.kernel.org/stable/c/9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b\"}, {\"url\": \"https://git.kernel.org/stable/c/e9dac92f4482a382e8c0fe1bc243da5fc3526b0c\"}, {\"url\": \"https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: add refcnt to ksmbd_conn struct\\n\\nWhen sending an oplock break request, opinfo-\u003econn is used,\\nBut freed -\u003econn can be used on multichannel.\\nThis patch add a reference count to the ksmbd_conn struct\\nso that it can be freed when it is no longer used.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:43:24.474Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49988\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:43:24.474Z\", \"dateReserved\": \"2024-10-21T12:17:06.054Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:31.845Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.