CVE-2024-56729

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56729
In the Linux kernel, the following vulnerability has been resolved: smb: Initialize cfid->tcon before performing network ops Avoid leaking a tcon ref when a lease break races with opening the cached directory. Processing the leak break might take a reference to the tcon in cached_dir_lease_break() and then fail to release the ref in cached_dir_offload_close, since cfid->tcon is still NULL.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262 Patch
https://git.kernel.org/stable/c/4b216c8f9c7d84ef7de33ca60b97e08e03ef3292 Patch
https://git.kernel.org/stable/c/625e2357c8fcfae6e66dcc667dc656fe390bab15 Patch
https://git.kernel.org/stable/c/c353ee4fb119a2582d0e011f66a76a38f5cf984d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Jan 2025, 21:53

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: inicializar cfid->tcon antes de realizar operaciones de red Evitar la fuga de una referencia tcon cuando una interrupción de arrendamiento se ejecuta con la apertura del directorio en caché. El procesamiento de la interrupción de la fuga puede tomar una referencia al tcon en cached_dir_lease_break() y luego no liberar la referencia en cached_dir_offload_close, ya que cfid->tcon sigue siendo NULL.
References () https://git.kernel.org/stable/c/1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262 - () https://git.kernel.org/stable/c/1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262 - Patch
References () https://git.kernel.org/stable/c/4b216c8f9c7d84ef7de33ca60b97e08e03ef3292 - () https://git.kernel.org/stable/c/4b216c8f9c7d84ef7de33ca60b97e08e03ef3292 - Patch
References () https://git.kernel.org/stable/c/625e2357c8fcfae6e66dcc667dc656fe390bab15 - () https://git.kernel.org/stable/c/625e2357c8fcfae6e66dcc667dc656fe390bab15 - Patch
References () https://git.kernel.org/stable/c/c353ee4fb119a2582d0e011f66a76a38f5cf984d - () https://git.kernel.org/stable/c/c353ee4fb119a2582d0e011f66a76a38f5cf984d - Patch

29 Dec 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-29 12:15

Updated : 2025-10-01 20:17

NVD link : CVE-2024-56729

Mitre link : CVE-2024-56729

CVE.ORG link : CVE-2024-56729

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime