CVE-2024-50285

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: check outstanding simultaneous SMB operations

If Client send simultaneous SMB operations to ksmbd, It exhausts too much memory through the "ksmbd_work_cache”. It will cause OOM issue. ksmbd has a credit mechanism but it can't handle this problem. This patch add the check if it exceeds max credits to prevent this problem by assuming that one smb request consumes at least one credit.

A low severity flaw was found in the Linux kernel's ksmbd in-kernel SMB3 server. A client that sends a large number of simultaneous SMB operations to a host running the ksmbd server can exhaust kernel memory through the ksmbd_work_cache, because ksmbd's credit mechanism does not limit outstanding simultaneous operations, causing an out-of-memory condition that results in a denial of service. Only availability is affected; there is no impact on confidentiality or integrity. Only systems running a kernel that provides and enables the ksmbd SMB server are exposed to this flaw. Red Hat Enterprise Linux 6, 7, 8, and 9, including the kernel and kernel-rt packages, as well as Red Hat's Hosted OpenShift offerings, are not affected because the ksmbd module is not supported and not enabled in those kernels. The only affected Red Hat maintained software is the Fedora community kernel, for which a fix is being pursued by the community through the delegated resolution. The upstream fix adds a check that rejects requests when outstanding simultaneous SMB operations exceed the maximum number of SMB credits, based on the assumption that each SMB request consumes at least one credit. The CVE.org record scores this issue 7.5 (Important) with a network attack vector requiring no privileges, whereas Red Hat scores it 5.5 (Moderate) with a local attack vector and low privileges required, reflecting a conservative assessment of this availability-only memory exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.