363 lines
17 KiB
JSON
363 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-39468",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-06-25T14:23:23.744Z",
|
|
"datePublished": "2024-06-25T14:28:54.897Z",
|
|
"dateUpdated": "2026-10-15T00:44:02.956Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:33:26.449Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix deadlock in smb2_find_smb_tcon()\n\nUnlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such\ndeadlock."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The vulnerable lookup is driven entirely by the SessionId and TreeId fields parsed out of an SMB2 response header received over TCP/445 from the remote SMB server, so a malicious/compromised server or an on-path attacker injecting a spoofed response (this path bypasses signature verification, as cancelled mids never reach cifs_check_receive) reaches it remotely.\nAC:L - Once a CREATE mid is cancelled, the attacker deterministically triggers the self-deadlock by returning STATUS_SUCCESS with a TreeId it fully controls, and it can force the cancellation precondition at will by stalling responses until the hung process is killed; no memory-layout precision or race window is involved and attempts can be repeated indefinitely.\nPR:N - The attacking SMB server needs no account, credential, or privilege on the victim client system; it only has to respond to the client's own in-flight request on an established connection.\nUI:N - With a mount already established (fstab, autofs, or a persistent share) and the server compromised or MITM'd, the malicious response is processed by the cifsd kernel thread with no victim action required; the cancellation trigger comes from ordinary kill/timeout/OOM machinery, not deliberate user interaction.\nS:U - The deadlock occurs in the kernel's CIFS client and its impact is confined to that same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The bug is a pure spinlock recursion with no out-of-bounds access, uninitialized data, or freed-object reuse, so no kernel memory is disclosed.\nI:N - No memory is corrupted and no data is modified; the CPU simply spins forever on an already-held lock, giving the attacker no write primitive.\nA:H - The cifsd demux thread deadlocks with preemption disabled while permanently holding the global cifs_tcp_ses_lock, so every CIFS operation on every mount system-wide spins forever and cascades across CPUs, producing an unrecoverable hang and soft/hard lockup panic."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/client/smb2transport.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "78ebec450ef4f0720c592638d92bad679d75d7ce",
|
|
"lessThan": "b055752675cd1d1db4ac9c2750db3dc3e89ea261",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e695a9ad0305af6e8b0cbc24a54976ac2120cbb3",
|
|
"lessThan": "21f5dd36e655d25a7b45b61c1e537198b671f720",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e695a9ad0305af6e8b0cbc24a54976ac2120cbb3",
|
|
"lessThan": "b09b556e48968317887a11243a5331a7bc00ece5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e695a9ad0305af6e8b0cbc24a54976ac2120cbb3",
|
|
"lessThan": "225de871ddf994f69a57f035709cad9c0ab8615a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e695a9ad0305af6e8b0cbc24a54976ac2120cbb3",
|
|
"lessThan": "8d0f5f1ccf675454a833a573c53830a49b7d1a47",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e695a9ad0305af6e8b0cbc24a54976ac2120cbb3",
|
|
"lessThan": "02c418774f76a0a36a6195c9dbf8971eb4130a15",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/smb/client/smb2transport.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.14",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.14",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.162",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.94",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.34",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.9.5",
|
|
"lessThanOrEqual": "6.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.14",
|
|
"versionEndExcluding": "5.15.162"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.14",
|
|
"versionEndExcluding": "6.1.94"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.14",
|
|
"versionEndExcluding": "6.6.34"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.14",
|
|
"versionEndExcluding": "6.9.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.14",
|
|
"versionEndExcluding": "6.10"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b055752675cd1d1db4ac9c2750db3dc3e89ea261"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/21f5dd36e655d25a7b45b61c1e537198b671f720"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b09b556e48968317887a11243a5331a7bc00ece5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/225de871ddf994f69a57f035709cad9c0ab8615a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8d0f5f1ccf675454a833a573c53830a49b7d1a47"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/02c418774f76a0a36a6195c9dbf8971eb4130a15"
|
|
}
|
|
],
|
|
"title": "smb: client: fix deadlock in smb2_find_smb_tcon()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-02T04:26:15.555Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b055752675cd1d1db4ac9c2750db3dc3e89ea261",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/21f5dd36e655d25a7b45b61c1e537198b671f720",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b09b556e48968317887a11243a5331a7bc00ece5",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/225de871ddf994f69a57f035709cad9c0ab8615a",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8d0f5f1ccf675454a833a573c53830a49b7d1a47",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/02c418774f76a0a36a6195c9dbf8971eb4130a15",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2024-39468",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2024-09-10T17:07:58.449670Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-09-11T17:34:41.922Z"
|
|
}
|
|
},
|
|
{
|
|
"x_adpType": "supplier",
|
|
"providerMetadata": {
|
|
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
|
"shortName": "siemens-SADP",
|
|
"dateUpdated": "2026-10-15T00:44:02.956Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "RUGGEDCOM RST2428P",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V3.1",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
|
|
"versions": [
|
|
{
|
|
"status": "unaffected",
|
|
"version": "0",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V3.1",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V1.1.1",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |