CVE-2024-50047 (GCVE-0-2024-50047)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-08-05 11:41
VLAI
Title
smb: client: fix UAF in async decryption
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dump_stack_lvl+0x4e/0x70 [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110 [ 194.200809] print_report+0x174/0x505 [ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 194.201352] ? srso_return_thunk+0x5/0x5f [ 194.201604] ? __virt_addr_valid+0xdf/0x1c0 [ 194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs] This is because TFM is being used in parallel. Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()). Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 35cf94a397280b9e27576ac1480f631bdd3e7b70 , < 8f14a476abba13144df5434871a7225fd29af633 (git)
Affected: 35cf94a397280b9e27576ac1480f631bdd3e7b70 , < ef51c0d544b1518b35364480317ab6d3468f205d (git)
Affected: 35cf94a397280b9e27576ac1480f631bdd3e7b70 , < bce966530fd5542bbb422cb45ecb775f7a1a6bc3 (git)
Affected: 35cf94a397280b9e27576ac1480f631bdd3e7b70 , < 0809fb86ad13b29e1d6d491364fc7ea4fb545995 (git)
Affected: 35cf94a397280b9e27576ac1480f631bdd3e7b70 , < 538c26d9bf70c90edc460d18c81008a4e555925a (git)
Affected: 35cf94a397280b9e27576ac1480f631bdd3e7b70 , < b0abcd65ec545701b8793e12bc27dc98042b151a (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.10.237 , ≤ 5.10.* (semver)
Unaffected: 5.15.181 , ≤ 5.15.* (semver)
Unaffected: 6.1.128 , ≤ 6.1.* (semver)
Unaffected: 6.6.57 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:23:59.456851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:43.459Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:43:16.334Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f14a476abba13144df5434871a7225fd29af633",
              "status": "affected",
              "version": "35cf94a397280b9e27576ac1480f631bdd3e7b70",
              "versionType": "git"
            },
            {
              "lessThan": "ef51c0d544b1518b35364480317ab6d3468f205d",
              "status": "affected",
              "version": "35cf94a397280b9e27576ac1480f631bdd3e7b70",
              "versionType": "git"
            },
            {
              "lessThan": "bce966530fd5542bbb422cb45ecb775f7a1a6bc3",
              "status": "affected",
              "version": "35cf94a397280b9e27576ac1480f631bdd3e7b70",
              "versionType": "git"
            },
            {
              "lessThan": "0809fb86ad13b29e1d6d491364fc7ea4fb545995",
              "status": "affected",
              "version": "35cf94a397280b9e27576ac1480f631bdd3e7b70",
              "versionType": "git"
            },
            {
              "lessThan": "538c26d9bf70c90edc460d18c81008a4e555925a",
              "status": "affected",
              "version": "35cf94a397280b9e27576ac1480f631bdd3e7b70",
              "versionType": "git"
            },
            {
              "lessThan": "b0abcd65ec545701b8793e12bc27dc98042b151a",
              "status": "affected",
              "version": "35cf94a397280b9e27576ac1480f631bdd3e7b70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.128",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.57",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in async decryption\n\nDoing an async decryption (large read) crashes with a\nslab-use-after-free way down in the crypto API.\n\nReproducer:\n    # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\n    # dd if=/mnt/largefile of=/dev/null\n    ...\n    [  194.196391] ==================================================================\n    [  194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\n    [  194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\n    [  194.197707]\n    [  194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\n    [  194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\n    [  194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\n    [  194.200032] Call Trace:\n    [  194.200191]  \u003cTASK\u003e\n    [  194.200327]  dump_stack_lvl+0x4e/0x70\n    [  194.200558]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.200809]  print_report+0x174/0x505\n    [  194.201040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n    [  194.201352]  ? srso_return_thunk+0x5/0x5f\n    [  194.201604]  ? __virt_addr_valid+0xdf/0x1c0\n    [  194.201868]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.202128]  kasan_report+0xc8/0x150\n    [  194.202361]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.202616]  gf128mul_4k_lle+0xc1/0x110\n    [  194.202863]  ghash_update+0x184/0x210\n    [  194.203103]  shash_ahash_update+0x184/0x2a0\n    [  194.203377]  ? __pfx_shash_ahash_update+0x10/0x10\n    [  194.203651]  ? srso_return_thunk+0x5/0x5f\n    [  194.203877]  ? crypto_gcm_init_common+0x1ba/0x340\n    [  194.204142]  gcm_hash_assoc_remain_continue+0x10a/0x140\n    [  194.204434]  crypt_message+0xec1/0x10a0 [cifs]\n    [  194.206489]  ? __pfx_crypt_message+0x10/0x10 [cifs]\n    [  194.208507]  ? srso_return_thunk+0x5/0x5f\n    [  194.209205]  ? srso_return_thunk+0x5/0x5f\n    [  194.209925]  ? srso_return_thunk+0x5/0x5f\n    [  194.210443]  ? srso_return_thunk+0x5/0x5f\n    [  194.211037]  decrypt_raw_data+0x15f/0x250 [cifs]\n    [  194.212906]  ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\n    [  194.214670]  ? srso_return_thunk+0x5/0x5f\n    [  194.215193]  smb2_decrypt_offload+0x12a/0x6c0 [cifs]\n\nThis is because TFM is being used in parallel.\n\nFix this by allocating a new AEAD TFM for async decryption, but keep\nthe existing one for synchronous READ cases (similar to what is done\nin smb3_calc_signature()).\n\nAlso remove the calls to aead_request_set_callback() and\ncrypto_wait_req() since it\u0027s always going to be a synchronous operation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF occurs while the CIFS/SMB3 client decrypts transform-encrypted READ responses received from a remote SMB server over TCP/445, on data (transform header, message size, nonce, ciphertext) fully supplied by that peer. A malicious, compromised, or MITM\u0027d server drives the vulnerable path remotely, and can itself force encryption on via SMB2_SESSION_FLAG_ENCRYPT_DATA / SHI1005_FLAGS_ENCRYPT_DATA.\nAC:L - The server controls both sides of the race by pipelining multiple large encrypted READ responses, guaranteeing concurrent smb3decryptd workers on the shared TFM; the commit\u0027s reproducer is an ordinary `dd` of a large file, so the corruption occurs deterministically in normal operation rather than requiring a rare window.\nPR:N - The remote SMB server needs no privileges on the client to send the encrypted read responses that trigger the parallel TFM use, and locally any unprivileged user with read access to the mounted share can issue the concurrent large reads.\nUI:N - No victim action is needed beyond an already-established mount; the UAF fires during routine background file reads on the existing connection.\nS:U - The corruption is confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Freed slab memory (the gf128mul ghash key table and TFM context) is read by the crypto engine, and heap grooming lets an attacker place chosen objects there for arbitrary kernel memory disclosure; cross-worker key clobbering can also expose data decrypted under the wrong session key.\nI:H - The crypto transform writes into the freed, reallocated slab object, giving a heap write primitive over attacker-groomable memory that is leveragable for control-flow hijack, and concurrent setkey/setauthsize corrupt in-flight crypto state.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free and kernel oops in the smb3decryptd workqueue, panicking or hanging the client; it can be retriggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:16.159Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f14a476abba13144df5434871a7225fd29af633"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef51c0d544b1518b35364480317ab6d3468f205d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bce966530fd5542bbb422cb45ecb775f7a1a6bc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0809fb86ad13b29e1d6d491364fc7ea4fb545995"
        },
        {
          "url": "https://git.kernel.org/stable/c/538c26d9bf70c90edc460d18c81008a4e555925a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0abcd65ec545701b8793e12bc27dc98042b151a"
        }
      ],
      "title": "smb: client: fix UAF in async decryption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50047",
    "datePublished": "2024-10-21T19:39:44.430Z",
    "dateReserved": "2024-10-21T12:17:06.071Z",
    "dateUpdated": "2026-08-05T11:41:16.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50047",
      "date": "2026-08-09",
      "epss": "0.00522",
      "percentile": "0.41489"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.6.57\", \"matchCriteriaId\": \"D50B3F37-2EA9-4348-B50C-34DCAAF2076E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.4\", \"matchCriteriaId\": \"AA84D336-CE9A-4535-B901-1AD77EC17C34\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix UAF in async decryption\\n\\nDoing an async decryption (large read) crashes with a\\nslab-use-after-free way down in the crypto API.\\n\\nReproducer:\\n    # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\\n    # dd if=/mnt/largefile of=/dev/null\\n    ...\\n    [  194.196391] ==================================================================\\n    [  194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\\n    [  194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\\n    [  194.197707]\\n    [  194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\\n    [  194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\\n    [  194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\\n    [  194.200032] Call Trace:\\n    [  194.200191]  \u003cTASK\u003e\\n    [  194.200327]  dump_stack_lvl+0x4e/0x70\\n    [  194.200558]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.200809]  print_report+0x174/0x505\\n    [  194.201040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n    [  194.201352]  ? srso_return_thunk+0x5/0x5f\\n    [  194.201604]  ? __virt_addr_valid+0xdf/0x1c0\\n    [  194.201868]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.202128]  kasan_report+0xc8/0x150\\n    [  194.202361]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.202616]  gf128mul_4k_lle+0xc1/0x110\\n    [  194.202863]  ghash_update+0x184/0x210\\n    [  194.203103]  shash_ahash_update+0x184/0x2a0\\n    [  194.203377]  ? __pfx_shash_ahash_update+0x10/0x10\\n    [  194.203651]  ? srso_return_thunk+0x5/0x5f\\n    [  194.203877]  ? crypto_gcm_init_common+0x1ba/0x340\\n    [  194.204142]  gcm_hash_assoc_remain_continue+0x10a/0x140\\n    [  194.204434]  crypt_message+0xec1/0x10a0 [cifs]\\n    [  194.206489]  ? __pfx_crypt_message+0x10/0x10 [cifs]\\n    [  194.208507]  ? srso_return_thunk+0x5/0x5f\\n    [  194.209205]  ? srso_return_thunk+0x5/0x5f\\n    [  194.209925]  ? srso_return_thunk+0x5/0x5f\\n    [  194.210443]  ? srso_return_thunk+0x5/0x5f\\n    [  194.211037]  decrypt_raw_data+0x15f/0x250 [cifs]\\n    [  194.212906]  ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\\n    [  194.214670]  ? srso_return_thunk+0x5/0x5f\\n    [  194.215193]  smb2_decrypt_offload+0x12a/0x6c0 [cifs]\\n\\nThis is because TFM is being used in parallel.\\n\\nFix this by allocating a new AEAD TFM for async decryption, but keep\\nthe existing one for synchronous READ cases (similar to what is done\\nin smb3_calc_signature()).\\n\\nAlso remove the calls to aead_request_set_callback() and\\ncrypto_wait_req() since it\u0027s always going to be a synchronous operation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: corregir UAF en descifrado asincr\\u00f3nico Al realizar un descifrado asincr\\u00f3nico (lectura grande), se produce un bloqueo con un m\\u00e9todo slab-use-after-free en la API de cifrado. Reproductor: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ===================================================================== [ 194.196844] ERROR: KASAN: slab-use-after-free en gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff888112bd0448 por la tarea kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 No contaminado 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Cola de trabajo: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Seguimiento de llamadas: [ 194.200191]  [ [194.200327] dump_stack_lvl+0x4e/0x70 [194.200558] ? gf128mul_4k_lle+0xc1/0x110 [194.200809] print_report+0x174/0x505 [194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [194.201352] ? srso_return_thunk+0x5/0x5f [194.201604] ? __virt_addr_valid+0xdf/0x1c0 [194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs] Esto se debe a que TFM se est\\u00e1 utilizando en paralelo. Solucione esto asignando un nuevo TFM AEAD para el descifrado asincr\\u00f3nico, pero conserve el existente para los casos de LECTURA sincr\\u00f3nica (similar a lo que se hace en smb3_calc_signature()). Tambi\\u00e9n elimine las llamadas a aead_request_set_callback() y crypto_wait_req() ya que siempre ser\\u00e1 una operaci\\u00f3n sincr\\u00f3nica.\"}]",
      "id": "CVE-2024-50047",
      "lastModified": "2024-10-23T22:16:21.783",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T20:15:17.507",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0809fb86ad13b29e1d6d491364fc7ea4fb545995\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/538c26d9bf70c90edc460d18c81008a4e555925a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b0abcd65ec545701b8793e12bc27dc98042b151a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:58:15.000Z",
      "cve": "CVE-2024-50047",
      "id": "msrc_CVE-2024-50047",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix UAF in async decryption",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50047.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50047\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:17.507\",\"lastModified\":\"2026-08-04T11:21:12.547\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix UAF in async decryption\\n\\nDoing an async decryption (large read) crashes with a\\nslab-use-after-free way down in the crypto API.\\n\\nReproducer:\\n    # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\\n    # dd if=/mnt/largefile of=/dev/null\\n    ...\\n    [  194.196391] ==================================================================\\n    [  194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\\n    [  194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\\n    [  194.197707]\\n    [  194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\\n    [  194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\\n    [  194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\\n    [  194.200032] Call Trace:\\n    [  194.200191]  \u003cTASK\u003e\\n    [  194.200327]  dump_stack_lvl+0x4e/0x70\\n    [  194.200558]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.200809]  print_report+0x174/0x505\\n    [  194.201040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n    [  194.201352]  ? srso_return_thunk+0x5/0x5f\\n    [  194.201604]  ? __virt_addr_valid+0xdf/0x1c0\\n    [  194.201868]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.202128]  kasan_report+0xc8/0x150\\n    [  194.202361]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.202616]  gf128mul_4k_lle+0xc1/0x110\\n    [  194.202863]  ghash_update+0x184/0x210\\n    [  194.203103]  shash_ahash_update+0x184/0x2a0\\n    [  194.203377]  ? __pfx_shash_ahash_update+0x10/0x10\\n    [  194.203651]  ? srso_return_thunk+0x5/0x5f\\n    [  194.203877]  ? crypto_gcm_init_common+0x1ba/0x340\\n    [  194.204142]  gcm_hash_assoc_remain_continue+0x10a/0x140\\n    [  194.204434]  crypt_message+0xec1/0x10a0 [cifs]\\n    [  194.206489]  ? __pfx_crypt_message+0x10/0x10 [cifs]\\n    [  194.208507]  ? srso_return_thunk+0x5/0x5f\\n    [  194.209205]  ? srso_return_thunk+0x5/0x5f\\n    [  194.209925]  ? srso_return_thunk+0x5/0x5f\\n    [  194.210443]  ? srso_return_thunk+0x5/0x5f\\n    [  194.211037]  decrypt_raw_data+0x15f/0x250 [cifs]\\n    [  194.212906]  ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\\n    [  194.214670]  ? srso_return_thunk+0x5/0x5f\\n    [  194.215193]  smb2_decrypt_offload+0x12a/0x6c0 [cifs]\\n\\nThis is because TFM is being used in parallel.\\n\\nFix this by allocating a new AEAD TFM for async decryption, but keep\\nthe existing one for synchronous READ cases (similar to what is done\\nin smb3_calc_signature()).\\n\\nAlso remove the calls to aead_request_set_callback() and\\ncrypto_wait_req() since it\u0027s always going to be a synchronous operation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: corregir UAF en descifrado asincr\u00f3nico Al realizar un descifrado asincr\u00f3nico (lectura grande), se produce un bloqueo con un m\u00e9todo slab-use-after-free en la API de cifrado. Reproductor: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ===================================================================== [ 194.196844] ERROR: KASAN: slab-use-after-free en gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888112bd0448 por la tarea kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 No contaminado 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Cola de trabajo: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Seguimiento de llamadas: [ 194.200191]  [ [194.200327] dump_stack_lvl+0x4e/0x70 [194.200558] ? gf128mul_4k_lle+0xc1/0x110 [194.200809] print_report+0x174/0x505 [194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [194.201352] ? srso_return_thunk+0x5/0x5f [194.201604] ? __virt_addr_valid+0xdf/0x1c0 [194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs] Esto se debe a que TFM se est\u00e1 utilizando en paralelo. Solucione esto asignando un nuevo TFM AEAD para el descifrado asincr\u00f3nico, pero conserve el existente para los casos de LECTURA sincr\u00f3nica (similar a lo que se hace en smb3_calc_signature()). Tambi\u00e9n elimine las llamadas a aead_request_set_callback() y crypto_wait_req() ya que siempre ser\u00e1 una operaci\u00f3n sincr\u00f3nica.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2ops.c\",\"fs/smb/client/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"35cf94a397280b9e27576ac1480f631bdd3e7b70\",\"lessThan\":\"8f14a476abba13144df5434871a7225fd29af633\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"35cf94a397280b9e27576ac1480f631bdd3e7b70\",\"lessThan\":\"ef51c0d544b1518b35364480317ab6d3468f205d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"35cf94a397280b9e27576ac1480f631bdd3e7b70\",\"lessThan\":\"bce966530fd5542bbb422cb45ecb775f7a1a6bc3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"35cf94a397280b9e27576ac1480f631bdd3e7b70\",\"lessThan\":\"0809fb86ad13b29e1d6d491364fc7ea4fb545995\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"35cf94a397280b9e27576ac1480f631bdd3e7b70\",\"lessThan\":\"538c26d9bf70c90edc460d18c81008a4e555925a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"35cf94a397280b9e27576ac1480f631bdd3e7b70\",\"lessThan\":\"b0abcd65ec545701b8793e12bc27dc98042b151a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb2ops.c\",\"fs/smb/client/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.237\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.181\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.128\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.57\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.4\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:23:59.456851Z\",\"id\":\"CVE-2024-50047\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.57\",\"matchCriteriaId\":\"D50B3F37-2EA9-4348-B50C-34DCAAF2076E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"AA84D336-CE9A-4535-B901-1AD77EC17C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0809fb86ad13b29e1d6d491364fc7ea4fb545995\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/538c26d9bf70c90edc460d18c81008a4e555925a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8f14a476abba13144df5434871a7225fd29af633\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0abcd65ec545701b8793e12bc27dc98042b151a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bce966530fd5542bbb422cb45ecb775f7a1a6bc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef51c0d544b1518b35364480317ab6d3468f205d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:48:03+00:00",
      "cve": "CVE-2024-50047",
      "id": "CVE-2024-50047",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix UAF in async decryption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50047.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T01:29:15Z",
      "cve": "CVE-2024-50047",
      "id": "CVE-2024-50047",
      "initial_release_date": "2024-10-22T02:49:44Z",
      "product_status:known_affected": "419",
      "product_status:known_not_affected": "80",
      "product_status:recommended": "971",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50047",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50047.json",
      "version": "89"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:43:16.334Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50047\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:23:59.456851Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:24:02.635Z\"}}], \"cna\": {\"title\": \"smb: client: fix UAF in async decryption\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"35cf94a397280b9e27576ac1480f631bdd3e7b70\", \"lessThan\": \"8f14a476abba13144df5434871a7225fd29af633\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"35cf94a397280b9e27576ac1480f631bdd3e7b70\", \"lessThan\": \"ef51c0d544b1518b35364480317ab6d3468f205d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"35cf94a397280b9e27576ac1480f631bdd3e7b70\", \"lessThan\": \"bce966530fd5542bbb422cb45ecb775f7a1a6bc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"35cf94a397280b9e27576ac1480f631bdd3e7b70\", \"lessThan\": \"0809fb86ad13b29e1d6d491364fc7ea4fb545995\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"35cf94a397280b9e27576ac1480f631bdd3e7b70\", \"lessThan\": \"538c26d9bf70c90edc460d18c81008a4e555925a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"35cf94a397280b9e27576ac1480f631bdd3e7b70\", \"lessThan\": \"b0abcd65ec545701b8793e12bc27dc98042b151a\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/client/smb2ops.c\", \"fs/smb/client/smb2pdu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.237\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.181\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.128\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/smb2ops.c\", \"fs/smb/client/smb2pdu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8f14a476abba13144df5434871a7225fd29af633\"}, {\"url\": \"https://git.kernel.org/stable/c/ef51c0d544b1518b35364480317ab6d3468f205d\"}, {\"url\": \"https://git.kernel.org/stable/c/bce966530fd5542bbb422cb45ecb775f7a1a6bc3\"}, {\"url\": \"https://git.kernel.org/stable/c/0809fb86ad13b29e1d6d491364fc7ea4fb545995\"}, {\"url\": \"https://git.kernel.org/stable/c/538c26d9bf70c90edc460d18c81008a4e555925a\"}, {\"url\": \"https://git.kernel.org/stable/c/b0abcd65ec545701b8793e12bc27dc98042b151a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix UAF in async decryption\\n\\nDoing an async decryption (large read) crashes with a\\nslab-use-after-free way down in the crypto API.\\n\\nReproducer:\\n    # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\\n    # dd if=/mnt/largefile of=/dev/null\\n    ...\\n    [  194.196391] ==================================================================\\n    [  194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\\n    [  194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\\n    [  194.197707]\\n    [  194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\\n    [  194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\\n    [  194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\\n    [  194.200032] Call Trace:\\n    [  194.200191]  \u003cTASK\u003e\\n    [  194.200327]  dump_stack_lvl+0x4e/0x70\\n    [  194.200558]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.200809]  print_report+0x174/0x505\\n    [  194.201040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n    [  194.201352]  ? srso_return_thunk+0x5/0x5f\\n    [  194.201604]  ? __virt_addr_valid+0xdf/0x1c0\\n    [  194.201868]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.202128]  kasan_report+0xc8/0x150\\n    [  194.202361]  ? gf128mul_4k_lle+0xc1/0x110\\n    [  194.202616]  gf128mul_4k_lle+0xc1/0x110\\n    [  194.202863]  ghash_update+0x184/0x210\\n    [  194.203103]  shash_ahash_update+0x184/0x2a0\\n    [  194.203377]  ? __pfx_shash_ahash_update+0x10/0x10\\n    [  194.203651]  ? srso_return_thunk+0x5/0x5f\\n    [  194.203877]  ? crypto_gcm_init_common+0x1ba/0x340\\n    [  194.204142]  gcm_hash_assoc_remain_continue+0x10a/0x140\\n    [  194.204434]  crypt_message+0xec1/0x10a0 [cifs]\\n    [  194.206489]  ? __pfx_crypt_message+0x10/0x10 [cifs]\\n    [  194.208507]  ? srso_return_thunk+0x5/0x5f\\n    [  194.209205]  ? srso_return_thunk+0x5/0x5f\\n    [  194.209925]  ? srso_return_thunk+0x5/0x5f\\n    [  194.210443]  ? srso_return_thunk+0x5/0x5f\\n    [  194.211037]  decrypt_raw_data+0x15f/0x250 [cifs]\\n    [  194.212906]  ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\\n    [  194.214670]  ? srso_return_thunk+0x5/0x5f\\n    [  194.215193]  smb2_decrypt_offload+0x12a/0x6c0 [cifs]\\n\\nThis is because TFM is being used in parallel.\\n\\nFix this by allocating a new AEAD TFM for async decryption, but keep\\nthe existing one for synchronous READ cases (similar to what is done\\nin smb3_calc_signature()).\\n\\nAlso remove the calls to aead_request_set_callback() and\\ncrypto_wait_req() since it\u0027s always going to be a synchronous operation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.237\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.181\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.128\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.57\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:54:46.912Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50047\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:54:46.912Z\", \"dateReserved\": \"2024-10-21T12:17:06.071Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:44.430Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.