CVE-2024-53186 (GCVE-0-2024-53186)
Vulnerability from cvelistv5
Published
2024-12-27 13:49
Modified
2025-05-04 13:00
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF, as `conn` has already been freed. The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests.
References
Impacted products
Vendor Product Version
Linux Linux Version: 18f06bacc197d4ac9b518ad1c69999bc3d83e7aa
Version: e9dac92f4482a382e8c0fe1bc243da5fc3526b0c
Version: ee426bfb9d09b29987369b897fe9b6485ac2be27
Version: ee426bfb9d09b29987369b897fe9b6485ac2be27
Version: 9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:13:00.740506Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T17:21:09.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/server.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a96f9eb7add30ba0fafcfe7b7aca090978196800",
              "status": "affected",
              "version": "18f06bacc197d4ac9b518ad1c69999bc3d83e7aa",
              "versionType": "git"
            },
            {
              "lessThan": "f20b77f7897e6aab9ce5527e6016ad2be5d70a33",
              "status": "affected",
              "version": "e9dac92f4482a382e8c0fe1bc243da5fc3526b0c",
              "versionType": "git"
            },
            {
              "lessThan": "96261adb998a3b513468b6ce17dbec76be5507d4",
              "status": "affected",
              "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
              "versionType": "git"
            },
            {
              "lessThan": "9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e",
              "status": "affected",
              "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/server.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "6.6.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.11.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in SMB request handling\n\nA race condition exists between SMB request handling in\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\n\nThis race condition arises as follows:\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\n  `ksmbd_conn_free()`, which frees `conn`.\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\n  it may still access `conn-\u003er_count_q` in the following line:\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\n  This results in a UAF, as `conn` has already been freed.\n\nThe discovery of this UAF can be referenced in the following PR for\nsyzkaller\u0027s support for SMB requests."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T13:00:39.217Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800"
        },
        {
          "url": "https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33"
        },
        {
          "url": "https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e"
        }
      ],
      "title": "ksmbd: fix use-after-free in SMB request handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53186",
    "datePublished": "2024-12-27T13:49:29.215Z",
    "dateReserved": "2024-11-19T17:17:25.012Z",
    "dateUpdated": "2025-05-04T13:00:39.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53186\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:26.083\",\"lastModified\":\"2025-02-10T18:15:28.447\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix use-after-free in SMB request handling\\n\\nA race condition exists between SMB request handling in\\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\\n\\nThis race condition arises as follows:\\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\\n  `ksmbd_conn_free()`, which frees `conn`.\\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\\n  it may still access `conn-\u003er_count_q` in the following line:\\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\\n  This results in a UAF, as `conn` has already been freed.\\n\\nThe discovery of this UAF can be referenced in the following PR for\\nsyzkaller\u0027s support for SMB requests.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se corrige el problema de use-after-free en la gesti\u00f3n de solicitudes SMB Existe una condici\u00f3n de ejecuci\u00f3n entre la gesti\u00f3n de solicitudes SMB en `ksmbd_conn_handler_loop()` y la liberaci\u00f3n de `ksmbd_conn` en el controlador de cola de trabajo `handle_ksmbd_work()`. Esto conduce a una UAF. - KASAN: slab-use-after-free Leer en handle_ksmbd_work - KASAN: slab-use-after-free en rtlock_slowlock_locked Esta condici\u00f3n de ejecuci\u00f3n surge de la siguiente manera: - `ksmbd_conn_handler_loop()` espera a que `conn-\u0026gt;r_count` llegue a cero: `wait_event(conn-\u0026gt;r_count_q, atomic_read(\u0026amp;conn-\u0026gt;r_count) == 0);` - Mientras tanto, `handle_ksmbd_work()` decrementa `conn-\u0026gt;r_count` usando `atomic_dec_return(\u0026amp;conn-\u0026gt;r_count)`, y si llega a cero, llama a `ksmbd_conn_free()`, que libera a `conn`. - Sin embargo, despu\u00e9s de que `handle_ksmbd_work()` disminuya `conn-\u0026gt;r_count`, a\u00fan puede acceder a `conn-\u0026gt;r_count_q` en la siguiente l\u00ednea: `waitqueue_active(\u0026amp;conn-\u0026gt;r_count_q)` o `wake_up(\u0026amp;conn-\u0026gt;r_count_q)` Esto da como resultado un UAF, ya que `conn` ya se ha liberado. Se puede hacer referencia al descubrimiento de este UAF en la siguiente PR para el soporte de syzkaller para solicitudes SMB.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.55\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"C813C628-8D83-4585-9CCE-3DE13EBB4454\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.14\",\"versionEndExcluding\":\"6.11\",\"matchCriteriaId\":\"41AB04F0-1096-4B39-8148-796AB65AA193\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11.3\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"C2F1D9BC-CB2F-488F-90F8-8456CD3C44CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53186\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-10T17:13:00.740506Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-10T17:13:02.169Z\"}}], \"cna\": {\"title\": \"ksmbd: fix use-after-free in SMB request handling\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"18f06bacc197d4ac9b518ad1c69999bc3d83e7aa\", \"lessThan\": \"a96f9eb7add30ba0fafcfe7b7aca090978196800\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9dac92f4482a382e8c0fe1bc243da5fc3526b0c\", \"lessThan\": \"f20b77f7897e6aab9ce5527e6016ad2be5d70a33\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ee426bfb9d09b29987369b897fe9b6485ac2be27\", \"lessThan\": \"96261adb998a3b513468b6ce17dbec76be5507d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ee426bfb9d09b29987369b897fe9b6485ac2be27\", \"lessThan\": \"9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/server/server.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/server/server.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800\"}, {\"url\": \"https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33\"}, {\"url\": \"https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4\"}, {\"url\": \"https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix use-after-free in SMB request handling\\n\\nA race condition exists between SMB request handling in\\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\\n\\nThis race condition arises as follows:\\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\\n  `ksmbd_conn_free()`, which frees `conn`.\\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\\n  it may still access `conn-\u003er_count_q` in the following line:\\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\\n  This results in a UAF, as `conn` has already been freed.\\n\\nThe discovery of this UAF can be referenced in the following PR for\\nsyzkaller\u0027s support for SMB requests.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.64\", \"versionStartIncluding\": \"6.6.55\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.11\", \"versionStartIncluding\": \"6.11.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.10.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T13:00:39.217Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53186\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T13:00:39.217Z\", \"dateReserved\": \"2024-11-19T17:17:25.012Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T13:49:29.215Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.