CVE-2024-35867

smb: client: fix potential UAF in cifs_stats_proc_show()

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to
avoid UAF.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: corrige UAF potencial en cifs_stats_proc_show() Omita las sesiones que se están eliminando (estado == SES_EXITING) para evitar UAF.

This update for the Linux Kernel 5.14.21-150400_24_111 fixes several issues. The following security issues were fixed. Fixed int overflow for stack access size. Sch_cake: do not call cake_destroy from cake_init. Fixed potential UAF in is_valid_oplock_break. Smb: client: fix use-after-free bug in cifs_debug_data_proc_show. Fixed potential UAF in smb2_is_network_name_deleted. Fixed potential UAF in cifs_stats_proc_show. Fixed potential UAF in smb2_is_valid_lease_break. Intermittent nfs mount failures. Fixed potential UAF in cifs_signal_cifsd_for_reconnect. Gpiolib: cdev: Fix use after free in lineinfo_changed_notify. Net: do not leave a dangling sk pointer, when socket creation fails hfsplus: fix uninit-value in copy_name. Fs/9p: only translate RWX permissions for plain 9P2000. Hsr: Prevent use after free in prp_create_tagged_frame. Fixed a general protection fault in i915_perf_open_ioctl. Set gtt bound flag in amdgpu_ttm_gart_bind. Fixed use-after-free bugs caused by sco_sock_timeout. Drm/client: Fully protect modes with dev->mode_config.mutex. Fixed false-positive lockdep splat for spin_lock in __unix_gc. Fixed double free of the ha->vp_map pointer. Fixed underflow in parse_server_interfaces. Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules. Fixed use-after-free in ip6_route_mpath_notify. Fixed memory corruption in wifi/iwlwifi. Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header. Fixed SDMA off-by-one error in _pad_sdma_tx_descs. Fixed a race condition in nfc_llcp_sock_get and nfc_llcp_sock_get_sn. Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOC_SETCONF ioctl that could lead to local privilege escalation.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-17 CVE Reserved
2024-05-19 CVE Published
2025-05-04 CVE Updated
2025-06-27 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (11)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/05/29/2
http://www.openwall.com/lists/oss-security/2024/05/30/1
http://www.openwall.com/lists/oss-security/2024/05/30/2

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/838ec01ea8d3deb5d123e8ed9022e8162dc3f503	2025-05-02
https://git.kernel.org/stable/c/bb6570085826291dc392005f9fec16ea5da3c8ad	2025-05-02
https://git.kernel.org/stable/c/16b7d785775eb03929766819415055e367398f49	2024-04-10
https://git.kernel.org/stable/c/c3cf8b74c57924c0985e49a1fdf02d3395111f39	2024-04-10
https://git.kernel.org/stable/c/1e12f0d5c66f07c934041621351973a116fa13c7	2024-04-10
https://git.kernel.org/stable/c/0865ffefea197b437ba78b5dd8d8e256253efd65	2024-04-03

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-35867	2024-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=2281754	2024-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.10.237 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.237"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.181 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.181"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.85 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.85"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.26 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.26"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.8.5 Search vendor "Linux" for product "Linux Kernel" and version " < 6.8.5"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.9 Search vendor "Linux" for product "Linux Kernel" and version " < 6.9"		en		Affected