Use-After-Free Vulnerability in Linux Kernel's ksmbd Package
Summary
DEBIAN-CVE-2024-53186: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in ksmbd_conn_handler_loop() and the freeing of k... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The ksmbd module enables SMB (Server Message Block) protocol support, allowing file sharing and printing services over a network. This vulnerability affects versions of the Linux kernel in Debian 13 and 14, specifically in the handling of SMB requests, which can lead to serious security issues if exploited.
Vulnerability Detail
In the Linux kernel, a race condition exists between the SMB request handling in the ksmbd_conn_handler_loop() function and the freeing of ksmbd_conn in the workqueue handler handle_ksmbd_work(). This leads to a use-after-free (UAF) condition, where memory that has already been freed is accessed, potentially allowing an attacker to execute arbitrary code or crash the system. The issue arises when ksmbd_conn_handler_loop() waits for conn->r_count to reach zero while handle_ksmbd_work() decrements conn->r_count and may free conn, leading to undefined behavior.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The use-after-free vulnerability in the Linux kernel's ksmbd package poses significant security risks. It is crucial for users of Debian 13 and 14 to update their systems to the patched version 6.12.3-1 to protect against potential exploits. Regular monitoring and vulnerability management practices, such as using Vulert, can help maintain system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Exploitation of this vulnerability could allow attackers to execute arbitrary code, leading to unauthorized access, data breaches, or system crashes.
Yes, the vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.3-1.
If you cannot update immediately, consider isolating the affected system from the network to mitigate potential exploitation until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
