{"timestamp":"2024-06-17T17:38:54.896093Z","id":"CVE-2024-35870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b327a717e506980399464e304e363f94f95eb7a1","lessThan":"755fe68cd4b59e1d2a2dd3286177fd4404f57fed","versionType":"git","status":"affected"},{"version":"b327a717e506980399464e304e363f94f95eb7a1","lessThan":"6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0","versionType":"git","status":"affected"},{"version":"b327a717e506980399464e304e363f94f95eb7a1","lessThan":"45f2beda1f1bc3d962ec07db1ccc3197c25499a5","versionType":"git","status":"affected"},{"version":"b327a717e506980399464e304e363f94f95eb7a1","lessThan":"24a9799aa8efecd0eb55a75e35f9d8e6400063aa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.1.121","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.29","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.8.5","lessThanOrEqual":"6.8.*","versionType":"semver","status":"unaffected"},{"version":"6.9","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

OR
          *cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.29
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.8.5
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.121

CVE: https://git.kernel.org/stable/c/24a9799aa8efecd0eb55a75e35f9d8e6400063aa Types: Patch

CVE: https://git.kernel.org/stable/c/45f2beda1f1bc3d962ec07db1ccc3197c25499a5 Types: Patch

CVE: https://git.kernel.org/stable/c/6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0 Types: Patch

kernel.org: https://git.kernel.org/stable/c/24a9799aa8efecd0eb55a75e35f9d8e6400063aa Types: Patch

kernel.org: https://git.kernel.org/stable/c/45f2beda1f1bc3d962ec07db1ccc3197c25499a5 Types: Patch

kernel.org: https://git.kernel.org/stable/c/6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0 Types: Patch

kernel.org: https://git.kernel.org/stable/c/755fe68cd4b59e1d2a2dd3286177fd4404f57fed Types: Patch

https://git.kernel.org/stable/c/755fe68cd4b59e1d2a2dd3286177fd4404f57fed

https://git.kernel.org/stable/c/24a9799aa8efecd0eb55a75e35f9d8e6400063aa

https://git.kernel.org/stable/c/45f2beda1f1bc3d962ec07db1ccc3197c25499a5

https://git.kernel.org/stable/c/6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0

CISA-ADP AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA-ADP CWE-416

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF in smb2_reconnect_server()

The UAF bug is due to smb2_reconnect_server() accessing a session that
is already being teared down by another thread that is executing
__cifs_put_smb_ses().  This can happen when (a) the client has
connection to the server but no session or (b) another thread ends up
setting @ses->ses_status again to something different than
SES_EXITING.

To fix this, we need to make sure to unconditionally set
@ses->ses_status to SES_EXITING and prevent any other threads from
setting a new status while we're still tearing it down.

The following can be reproduced by adding some delay to right after
the ipc is freed in __cifs_put_smb_ses() - which will give
smb2_reconnect_server() worker a chance to run and then accessing
@ses->ipc:

kinit ...
mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10
[disconnect srv]
ls /mnt/1 &>/dev/null
sleep 30
kdestroy
[reconnect srv]
sleep 10
umount /mnt/1
...
CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
CIFS: VFS: \\srv Send error in SessSetup = -126
CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
CIFS: VFS: \\srv Send error in SessSetup = -126
general protection fault, probably for non-canonical address
0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI
CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39
04/01/2014
Workqueue: cifsiod smb2_reconnect_server [cifs]
RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0
Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad
de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75
7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8
RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83
RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b
RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800
RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000

kernel.org https://git.kernel.org/stable/c/24a9799aa8efecd0eb55a75e35f9d8e6400063aa [No types assigned]

kernel.org https://git.kernel.org/stable/c/45f2beda1f1bc3d962ec07db1ccc3197c25499a5 [No types assigned]

kernel.org https://git.kernel.org/stable/c/6202996a1c1887e83d0b3b0fcd86d0e5e6910ea0 [No types assigned]