{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49988", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.054Z", "datePublished": "2024-10-21T18:02:31.845Z", "dateUpdated": "2026-08-05T11:40:55.820Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:55.820Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add refcnt to ksmbd_conn struct\n\nWhen sending an oplock break request, opinfo->conn is used,\nBut freed ->conn can be used on multichannel.\nThis patch add a reference count to the ksmbd_conn struct\nso that it can be freed when it is no longer used." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is in the in-kernel SMB server (fs/smb/server/), driven entirely by SMB2/3 traffic on TCP/445 — the attacker triggers it by opening connections, binding a second channel, dropping the first, and issuing CREATE/WRITE requests that force an oplock/lease break. No local access is needed.\nAC:L - The attacker controls both sides of the sequence: they create the oplock/lease, they establish and tear down the channel that frees the ksmbd_conn, and they choose when to trigger the break that dereferences the stale pointer, so it is repeatable at will and can be retried indefinitely across connections. Heap grooming to reclaim the freed conn is done with attacker-sent SMB buffers, and the config-independent r_count/RELEASING TOCTOU offers an additional path.\nPR:L - An authenticated SMB session is required — oplocks/leases are only created after session setup and tree connect, and multichannel binding is explicitly refused for guest users (user_guest() → -EOPNOTSUPP), so valid credentials are needed. No administrative or share-admin privileges are required beyond ordinary file access on an exported share.\nUI:N - The attacker performs every step from its own SMB connections — open with a batch oplock/lease, bind a channel, disconnect it, then re-open or write the file to force the break. No action by an administrator or another user is required.\nS:U - The use-after-free corrupts kernel heap memory belonging to the ksmbd server and is exploited within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed struct ksmbd_conn is read back in multiple paths (compare_guid_key reads conn->ClientGUID, ksmbd_conn_write follows conn->transport->ops), so reclaiming the slab object with attacker-shaped data turns these into a kernel-memory read/disclosure primitive, and break notifications built from the stale conn can leak kernel data to the wire.\nI:H - The same dangling pointer is written through — atomic_inc/dec on conn->r_count, mutex_lock(&conn->srv_mutex), and wake_up(&conn->r_count_q) traversing a freed waitqueue — and conn->transport->ops->writev is called indirectly, giving controlled-write and control-flow-hijack potential for full kernel compromise.\nA:H - Dereferencing and writing to the freed ksmbd_conn reliably corrupts the slab and oopses or panics the kernel (mutex/waitqueue operations on freed memory, indirect call through a stale transport pointer), taking down the whole system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/oplock.c", "fs/smb/server/vfs_cache.c" ], "versions": [ { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "18f06bacc197d4ac9b518ad1c69999bc3d83e7aa", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "e9dac92f4482a382e8c0fe1bc243da5fc3526b0c", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "ee426bfb9d09b29987369b897fe9b6485ac2be27", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.c", "fs/smb/server/connection.h", "fs/smb/server/oplock.c", "fs/smb/server/vfs_cache.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/18f06bacc197d4ac9b518ad1c69999bc3d83e7aa" }, { "url": "https://git.kernel.org/stable/c/9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b" }, { "url": "https://git.kernel.org/stable/c/e9dac92f4482a382e8c0fe1bc243da5fc3526b0c" }, { "url": "https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27" } ], "title": "ksmbd: add refcnt to ksmbd_conn struct", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-49988", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:31:36.656509Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:38:43.274Z" } } ] } }