CVE-2024-53179 (GCVE-0-2024-53179)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:49 – Updated: 2026-08-05 11:44
VLAI
Title
smb: client: fix use-after-free of signing key
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 32811d242ff6f28da2ab18c90a15e32fd958e774 , < 39619c65ab4bbb3e78c818f537687653e112764d (git)
Affected: 32811d242ff6f28da2ab18c90a15e32fd958e774 , < 0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591 (git)
Affected: 32811d242ff6f28da2ab18c90a15e32fd958e774 , < 343d7fe6df9e247671440a932b6a73af4fa86d95 (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53179",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:13:09.010478Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T17:21:09.328Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2proto.h",
            "fs/smb/client/smb2transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39619c65ab4bbb3e78c818f537687653e112764d",
              "status": "affected",
              "version": "32811d242ff6f28da2ab18c90a15e32fd958e774",
              "versionType": "git"
            },
            {
              "lessThan": "0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591",
              "status": "affected",
              "version": "32811d242ff6f28da2ab18c90a15e32fd958e774",
              "versionType": "git"
            },
            {
              "lessThan": "343d7fe6df9e247671440a932b6a73af4fa86d95",
              "status": "affected",
              "version": "32811d242ff6f28da2ab18c90a15e32fd958e774",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2proto.h",
            "fs/smb/client/smb2transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses-\u003eauth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A                         task B\ncifs_mount()\n dfs_mount_share()\n  get_session()\n   cifs_mount_get_session()    cifs_send_recv()\n    cifs_get_smb_ses()          compound_send_recv()\n     cifs_setup_session()        smb2_setup_request()\n      kfree_sensitive()           smb2_calc_signature()\n                                   crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses-\u003eauth_key.response by\nchecking whether @ses-\u003eses_status is SES_GOOD or SES_EXITING with\n@ses-\u003eses_lock held.  After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call -\u003elogoff() only\nwhen @ses was known to be good (e.g. valid -\u003eauth_key.response), so\nit\u0027s safe to access signing key when @ses-\u003eses_status == SES_EXITING."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable `smb2_calc_signature()` runs in the cifs demultiplex thread on every inbound signed SMB2/2.1 response (`smb2_check_receive` \u2192 `smb2_verify_signature`), while the freeing side (`cifs_setup_session()`) is entered on reconnect or DFS re-referral \u2014 both driven by the remote SMB server dropping the TCP connection or serving referrals. A malicious, compromised, or spoofed server (or an on-path attacker injecting RSTs) controls both halves of the race purely over the network.\nAC:L - The attacker owns both sides of the race and the window is server-timed: after the free, `auth_key.response` stays NULL across the entire multi-round-trip NTLMSSP handshake, whose latency the server dictates, while `SMB2_IOCTL`/`SMB2_TREE_CONNECT` deliberately bypass the reconnect serialization in `smb2_reconnect()` and go straight to signing. Triggering is repeatable and reliable, not dependent on any condition outside attacker control.\nPR:N - No credentials on the client are needed \u2014 the demultiplex/signing path performs no capability or permission check, and the remote peer needs no authentication to tear down the TCP connection or drive session re-setup on an existing mount. The attacker is the network peer, not a local user.\nUI:N - Against an already-established SMB2.1 signed mount the attacker forces reconnects and session re-setup at will; no administrator or user action is required at exploitation time. Concurrent requests are supplied by ordinary background client activity (echo, DFS referral, oplock traffic).\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed heap object is read and consumed as the HMAC-SHA256 signing key, and the resulting signature is transmitted back to the attacker, forming an oracle over reallocated kernel heap contents. The attacker additionally controls the object\u0027s kmalloc size class via the server-supplied NTLMSSP `TargetInfoArray.Length`, making the UAF read a groomable arbitrary-disclosure primitive.\nI:H - Because the attacker selects the slab and can refill the freed 16 bytes, the client can be made to sign SMB traffic with a key the attacker knows, destroying the integrity guarantee of SMB signing and enabling forged/modified filesystem traffic. As a use-after-free it also carries the standard heap-corruption path to control-flow hijack.\nA:H - Once `auth_key.response` is NULLed, `crypto_shash_setkey(tfm, NULL, 16)` dereferences NULL and oopses the kernel; on the send path this occurs while `server-\u003esrv_mutex` is held, permanently wedging all further I/O on that mount. Customers reported this as a production crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:26.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591"
        },
        {
          "url": "https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95"
        }
      ],
      "title": "smb: client: fix use-after-free of signing key",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53179",
    "datePublished": "2024-12-27T13:49:22.982Z",
    "dateReserved": "2024-11-19T17:17:25.008Z",
    "dateUpdated": "2026-08-05T11:44:26.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53179",
      "date": "2026-08-05",
      "epss": "0.00603",
      "percentile": "0.45478"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix use-after-free of signing key\\n\\nCustomers have reported use-after-free in @ses-\u003eauth_key.response with\\nSMB2.1 + sign mounts which occurs due to following race:\\n\\ntask A                         task B\\ncifs_mount()\\n dfs_mount_share()\\n  get_session()\\n   cifs_mount_get_session()    cifs_send_recv()\\n    cifs_get_smb_ses()          compound_send_recv()\\n     cifs_setup_session()        smb2_setup_request()\\n      kfree_sensitive()           smb2_calc_signature()\\n                                   crypto_shash_setkey() *UAF*\\n\\nFix this by ensuring that we have a valid @ses-\u003eauth_key.response by\\nchecking whether @ses-\u003eses_status is SES_GOOD or SES_EXITING with\\n@ses-\u003eses_lock held.  After commit 24a9799aa8ef (\\\"smb: client: fix UAF\\nin smb2_reconnect_server()\\\"), we made sure to call -\u003elogoff() only\\nwhen @ses was known to be good (e.g. valid -\u003eauth_key.response), so\\nit\u0027s safe to access signing key when @ses-\u003eses_status == SES_EXITING.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: se corrige el use-after-free de la clave de firma Los clientes han informado sobre el use-after-free en @ses-\u0026gt;auth_key.response con SMB2.1 + montajes de firma que se producen debido a la siguiente ejecuci\\u00f3n: tarea A tarea B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() Compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Solucione esto asegur\\u00e1ndose de que tenemos un @ses-\u0026gt;auth_key.response v\\u00e1lido comprobando si @ses-\u0026gt;ses_status es SES_GOOD o SES_EXITING con @ses-\u0026gt;ses_lock Despu\\u00e9s de el commit 24a9799aa8ef (\\\"smb: cliente: corregir UAF en smb2_reconnect_server()\\\"), nos aseguramos de llamar a -\u0026gt;logoff() solo cuando se sab\\u00eda que @ses era correcto (por ejemplo, -\u0026gt;auth_key.response v\\u00e1lido), por lo que es seguro acceder a la clave de firma cuando @ses-\u0026gt;ses_status == SES_EXITING.\"}]",
      "id": "CVE-2024-53179",
      "lastModified": "2025-01-09T16:16:21.440",
      "published": "2024-12-27T14:15:25.307",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:50:13.000Z",
      "cve": "CVE-2024-53179",
      "id": "msrc_CVE-2024-53179",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix use-after-free of signing key",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53179.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53179\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:25.307\",\"lastModified\":\"2026-08-04T11:22:02.280\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix use-after-free of signing key\\n\\nCustomers have reported use-after-free in @ses-\u003eauth_key.response with\\nSMB2.1 + sign mounts which occurs due to following race:\\n\\ntask A                         task B\\ncifs_mount()\\n dfs_mount_share()\\n  get_session()\\n   cifs_mount_get_session()    cifs_send_recv()\\n    cifs_get_smb_ses()          compound_send_recv()\\n     cifs_setup_session()        smb2_setup_request()\\n      kfree_sensitive()           smb2_calc_signature()\\n                                   crypto_shash_setkey() *UAF*\\n\\nFix this by ensuring that we have a valid @ses-\u003eauth_key.response by\\nchecking whether @ses-\u003eses_status is SES_GOOD or SES_EXITING with\\n@ses-\u003eses_lock held.  After commit 24a9799aa8ef (\\\"smb: client: fix UAF\\nin smb2_reconnect_server()\\\"), we made sure to call -\u003elogoff() only\\nwhen @ses was known to be good (e.g. valid -\u003eauth_key.response), so\\nit\u0027s safe to access signing key when @ses-\u003eses_status == SES_EXITING.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: se corrige el use-after-free de la clave de firma Los clientes han informado sobre el use-after-free en @ses-\u0026gt;auth_key.response con SMB2.1 + montajes de firma que se producen debido a la siguiente ejecuci\u00f3n: tarea A tarea B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() Compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Solucione esto asegur\u00e1ndose de que tenemos un @ses-\u0026gt;auth_key.response v\u00e1lido comprobando si @ses-\u0026gt;ses_status es SES_GOOD o SES_EXITING con @ses-\u0026gt;ses_lock Despu\u00e9s de el commit 24a9799aa8ef (\\\"smb: cliente: corregir UAF en smb2_reconnect_server()\\\"), nos aseguramos de llamar a -\u0026gt;logoff() solo cuando se sab\u00eda que @ses era correcto (por ejemplo, -\u0026gt;auth_key.response v\u00e1lido), por lo que es seguro acceder a la clave de firma cuando @ses-\u0026gt;ses_status == SES_EXITING.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2proto.h\",\"fs/smb/client/smb2transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"32811d242ff6f28da2ab18c90a15e32fd958e774\",\"lessThan\":\"39619c65ab4bbb3e78c818f537687653e112764d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32811d242ff6f28da2ab18c90a15e32fd958e774\",\"lessThan\":\"0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32811d242ff6f28da2ab18c90a15e32fd958e774\",\"lessThan\":\"343d7fe6df9e247671440a932b6a73af4fa86d95\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb2proto.h\",\"fs/smb/client/smb2transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-10T17:13:09.010478Z\",\"id\":\"CVE-2024-53179\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"A5CDA440-0233-41C3-A5AE-5DE4FD068A1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"9C535878-0221-4BBF-824E-700AF4DD09BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:02:51+00:00",
      "cve": "CVE-2024-53179",
      "id": "CVE-2024-53179",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix use-after-free of signing key",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53179.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T01:21:24Z",
      "cve": "CVE-2024-53179",
      "id": "CVE-2024-53179",
      "initial_release_date": "2024-12-28T03:50:47Z",
      "product_status:known_affected": "505",
      "product_status:known_not_affected": "42",
      "product_status:recommended": "732",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53179",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53179.json",
      "version": "76"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53179\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-10T17:13:09.010478Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-10T17:13:10.325Z\"}}], \"cna\": {\"title\": \"smb: client: fix use-after-free of signing key\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"32811d242ff6f28da2ab18c90a15e32fd958e774\", \"lessThan\": \"39619c65ab4bbb3e78c818f537687653e112764d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"32811d242ff6f28da2ab18c90a15e32fd958e774\", \"lessThan\": \"0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"32811d242ff6f28da2ab18c90a15e32fd958e774\", \"lessThan\": \"343d7fe6df9e247671440a932b6a73af4fa86d95\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/client/smb2proto.h\", \"fs/smb/client/smb2transport.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/smb2proto.h\", \"fs/smb/client/smb2transport.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d\"}, {\"url\": \"https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591\"}, {\"url\": \"https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix use-after-free of signing key\\n\\nCustomers have reported use-after-free in @ses-\u003eauth_key.response with\\nSMB2.1 + sign mounts which occurs due to following race:\\n\\ntask A                         task B\\ncifs_mount()\\n dfs_mount_share()\\n  get_session()\\n   cifs_mount_get_session()    cifs_send_recv()\\n    cifs_get_smb_ses()          compound_send_recv()\\n     cifs_setup_session()        smb2_setup_request()\\n      kfree_sensitive()           smb2_calc_signature()\\n                                   crypto_shash_setkey() *UAF*\\n\\nFix this by ensuring that we have a valid @ses-\u003eauth_key.response by\\nchecking whether @ses-\u003eses_status is SES_GOOD or SES_EXITING with\\n@ses-\u003eses_lock held.  After commit 24a9799aa8ef (\\\"smb: client: fix UAF\\nin smb2_reconnect_server()\\\"), we made sure to call -\u003elogoff() only\\nwhen @ses was known to be good (e.g. valid -\u003eauth_key.response), so\\nit\u0027s safe to access signing key when @ses-\u003eses_status == SES_EXITING.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"3.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:55:42.113Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53179\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:55:42.113Z\", \"dateReserved\": \"2024-11-19T17:17:25.008Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T13:49:22.982Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.