{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49996", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.056Z", "datePublished": "2024-10-21T18:02:37.046Z", "dateUpdated": "2026-08-05T11:40:59.008Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:59.008Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix buffer overflow when parsing NFS reparse points\n\nReparseDataLength is sum of the InodeType size and DataBuffer size.\nSo to get DataBuffer size it is needed to subtract InodeType's size from\nReparseDataLength.\n\nFunction cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer\nat position after the end of the buffer because it does not subtract\nInodeType size from the length. Fix this problem and correctly subtract\nvariable len.\n\nMember InodeType is present only when reparse buffer is large enough. Check\nfor ReparseDataLength before accessing InodeType to prevent another invalid\nmemory access.\n\nMajor and minor rdev values are present also only when reparse buffer is\nlarge enough. Check for reparse buffer size before calling reparse_mkdev()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The malformed reparse buffer arrives in an SMB2/SMB1 FSCTL_GET_REPARSE_POINT response over TCP/445 from the remote server, so a malicious or compromised SMB server — or an on-path attacker tampering with an unsigned session — reaches the parser purely over the network.\nAC:L - The server fully controls ReparseTag, ReparseDataLength and the payload, so the out-of-bounds read is triggered deterministically on every lookup/stat of the crafted reparse point, with no race or unpredictable state involved.\nPR:N - The attacker is the remote peer (server or MITM) and needs no account, credentials or privileges on the victim client; the client parses the reparse data as part of normal metadata handling on the established connection.\nUI:N - Against an already-mounted share (the normal enterprise/automount case) any routine path lookup — ls, a backup job, an indexer — hits the parser, so a compromised server or MITM needs no victim action.\nS:U - The out-of-bounds read and the resulting disclosure/crash stay within the kernel of the client host; no VM, IOMMU or other security-authority boundary is crossed.\nC:H - Adjacent kernel heap memory read past the reparse buffer is converted into the symlink target string and the inode's st_rdev, both readable by any local user via readlink()/stat(), and the attacker can repeat it arbitrarily to sweep recycled SMB response buffers and neighbouring slab objects.\nI:L - There is no out-of-bounds write, but client-side filesystem metadata — the symlink target and the device major/minor stored in the inode cache — is built from out-of-bounds kernel memory, giving limited corruption of state the client presents to userspace.\nA:H - When the crafted response ends at the allocation boundary the read leaves the slab object and can touch an unmapped page or trip KASAN/hardening checks, producing an oops or panic that the remote attacker can trigger repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/reparse.c" ], "versions": [ { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "7b222d6cb87077faf56a687a72af1951cf78c8a9", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "73b078e3314d4854fd8286f3ba65c860ddd3a3dd", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "01cdddde39b065074fd48f07027757783cbf5b7d", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "ec79e6170bcae8a6036a4b6960f5e7e59a785601", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "c6db81c550cea0c73bd72ef55f579991e0e4ba07", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "803b3a39cb096d8718c0aebc03fd19f11c7dc919", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "c173d47b69f07cd7ca08efb4e458adbd4725d8e9", "status": "affected", "versionType": "git" }, { "version": "d5ecebc4900df7f6e8dff0717574668885110553", "lessThan": "e2a8910af01653c1c268984855629d71fb81f404", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/reparse.c" ], "versions": [ { "version": "5.3", "status": "affected" }, { "version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.4.287" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.10.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7b222d6cb87077faf56a687a72af1951cf78c8a9" }, { "url": "https://git.kernel.org/stable/c/73b078e3314d4854fd8286f3ba65c860ddd3a3dd" }, { "url": "https://git.kernel.org/stable/c/01cdddde39b065074fd48f07027757783cbf5b7d" }, { "url": "https://git.kernel.org/stable/c/ec79e6170bcae8a6036a4b6960f5e7e59a785601" }, { "url": "https://git.kernel.org/stable/c/c6db81c550cea0c73bd72ef55f579991e0e4ba07" }, { "url": "https://git.kernel.org/stable/c/803b3a39cb096d8718c0aebc03fd19f11c7dc919" }, { "url": "https://git.kernel.org/stable/c/c173d47b69f07cd7ca08efb4e458adbd4725d8e9" }, { "url": "https://git.kernel.org/stable/c/e2a8910af01653c1c268984855629d71fb81f404" } ], "title": "cifs: Fix buffer overflow when parsing NFS reparse points", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-49996", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:30:36.265660Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:38:41.853Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:42:50.666Z" } } ] } }