CVE-2024-50286

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock while adding/deleting session from global session table.

A LOW impact slab-use-after-free vulnerability was found in the ksmbd SMB server subsystem of the Linux kernel (fs/smb/server/mgmt/user_session.c). A race condition between ksmbd_smb2_session_create and ksmbd_expire_session, caused by a missing sessions_table_lock when adding or deleting sessions from the global session table, can lead to a use-after-free on a session object. Red Hat rated this flaw LOW impact with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which reflects a local attack vector with high attack complexity and privileges required; this differs significantly from the CVE.org record, which scores 9.8 assuming an unauthenticated network attack vector. Within the current Red Hat product scope, all Red Hat Enterprise Linux kernel and kernel-rt streams are marked not affected; only the Fedora community kernel is affected, and a fix there is being pursued through the community (delegated) update process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.