CVE-2024-35863: linux-libc-dev - Potential Use-After-Free Vulnerability in smb Client
Summary
CVE-2024-35863: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the necessary C library files for compiling and linking programs against the Linux kernel. It is an essential component for developing applications on Linux systems. The package contains various header files and static libraries that enable developers to interact with the kernel and access its functionalities. However, a vulnerability has been identified in the smb client component of linux-libc-dev, which could lead to a potential use-after-free (UAF) issue.
Vulnerability Detail
The vulnerability (CVE-2024-35863) in the smb client of linux-libc-dev arises from a failure to handle sessions that are being torn down. This can result in a use-after-free condition, where a pointer to freed memory is still accessed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact of this vulnerability is considered medium, with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the official patch or update the package to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
The linux-libc-dev package is vulnerable to a potential use-after-free issue in the smb client component. To mitigate this vulnerability, it is crucial to update the package to version 6.1.90-1 or later. Rebuilding applications that rely on linux-libc-dev is also recommended. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the necessary C library files for compiling and linking programs against the Linux kernel. It contains header files and static libraries that enable developers to interact with the kernel.
The vulnerability in the smb client of linux-libc-dev could allow an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
A use-after-free vulnerability occurs when a program continues to use a pointer to memory that has already been freed. This can lead to unpredictable behavior and potential security issues.
You can update the linux-libc-dev package by using package management tools like apt or by downloading the updated package from the official Debian repository.
Yes, it is recommended to rebuild any applications that depend on linux-libc-dev after updating to ensure they are using the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
