Deadlock Fix in Linux Kernel's SMB Client - CVE-2024-39468
Summary
CVE-2024-39468: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. It supports various file systems and network protocols, including SMB (Server Message Block), which allows for file sharing and network communication. The kernel's SMB client is crucial for enabling seamless interactions with remote file systems. However, vulnerabilities within this component can lead to severe issues, such as deadlocks that hinder system performance and stability.
Vulnerability Detail
CVE-2024-39468 is a vulnerability in the Linux kernel's SMB client that arises from a deadlock condition in the function smb2_find_smb_tcon(). This deadlock occurs when the cifs_tcp_ses_lock is not released before calling cifs_put_smb_ses(), leading to a situation where the system cannot proceed with operations, potentially freezing the affected services. The ramifications of this vulnerability can be significant, affecting system availability and user experience, especially in environments relying heavily on SMB for file sharing.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the necessary updates as outlined in the 'how_to_fix' section.
Conclusion
CVE-2024-39468 represents a significant vulnerability in the Linux kernel's SMB client, leading to potential deadlocks that can disrupt system operations. Users are strongly advised to update their systems to the latest kernel versions to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
CVE-2024-39468 is a vulnerability in the Linux kernel's SMB client that can lead to a deadlock, affecting system performance.
This vulnerability can cause deadlocks, potentially freezing services that rely on the SMB client for file sharing and network communication.
The vulnerability affects various versions of the Linux kernel across Debian 11, 12, and 13, specifically before the fixed versions.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your manifest file.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of deadlocks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
