Memory Allocation Failure in Linux Kernel's SMB Client - Linux Package Vulnerability
Summary
DEBIAN-CVE-2024-50120: In the Linux kernel, the following vulnerability has been resolved: smb: client: Handle kstrdup failures for passwords In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. The Linux package in Debian distributions is crucial for system stability and performance. This vulnerability affects the SMB (Server Message Block) client functionality, which is responsible for file sharing and network communication between systems. The vulnerability arises from improper handling of memory allocation failures, which could lead to system instability or crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SMB client where the function smb3_reconfigure() fails to properly handle memory allocation failures when duplicating password strings using kstrdup(). If the allocation for ses->password fails, the function should return -ENOMEM. If the allocation for ses->password2 fails, it should free ses->password, set it to NULL, and return -ENOMEM. This oversight can lead to potential denial of service conditions, as the system may not handle these errors gracefully.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
In summary, the vulnerability in the Linux kernel's SMB client poses a risk due to improper handling of memory allocation failures. It is crucial to update to the patched version 6.11.6-1 to mitigate potential risks. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of memory allocation failures in the SMB client of the Linux kernel.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability could lead to denial of service conditions, causing system instability or crashes.
Yes, the patched version is 6.11.6-1. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is recommended to monitor your system closely and apply the update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
