CVE-2024-50283
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In the Linux kernel, a slab-use-after-free vulnerability in the ksmbd server was fixed in the smb3_preauth_hash_rsp function. The ksmbd_user_session_put call should be made within smb3_preauth_hash_rsp to avoid freeing the session before use.
Risk Assessment
The vulnerability could lead to use-after-free, potentially causing system crashes or remote code execution by an attacker using SMB.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix for CVE-2024-50283.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_rsp().