CVE-2024-35866: linux-libc-dev - Potential Use-After-Free in cifs_dump_full_key()
Summary
CVE-2024-35866: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. This vulnerability affects the linux-libc-dev package version 6.1.90-1.
Vulnerability Detail
The vulnerability CVE-2024-35866 in the linux-libc-dev package is related to the SMB client functionality in the Linux kernel. It could lead to a potential Use-After-Free (UAF) vulnerability in the cifs_dump_full_key() function. By skipping sessions that are being torn down, the vulnerability is mitigated to avoid the UAF. Exploitation of this vulnerability could result in unauthorized access or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is recommended to apply the patch or update the package as soon as possible.
Conclusion
The linux-libc-dev package version 6.1.90-1 is affected by a potential Use-After-Free vulnerability in the cifs_dump_full_key() function. To mitigate the risk, it is crucial to update the package to a patched version. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems.
Exploitation of this vulnerability could result in unauthorized access or denial of service.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to a patched version. The latest version should include the necessary fixes to address the UAF vulnerability.
No specific workaround has been mentioned for this vulnerability. It is recommended to apply the patch or update the package as soon as possible.
You can find more information about this vulnerability in the provided references and the official documentation of the linux-libc-dev package.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
