Linux Kernel
CVE-2024-35870
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trigger is a local, timing-dependent race requiring an active SMB mount (AV:L, AC:H, PR:L); realistic impact is a kernel crash (A:H) with limited/uncertain C/I from the UAF (C:L/I:L).
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF in smb2_reconnect_server()
The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING.
To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXITING and prevent any other threads from setting a new status while we're still tearing it down.
The following can be reproduced by adding some delay to right after the ipc is freed in __cifs_put_smb_ses() - which will give smb2_reconnect_server() worker a chance to run and then accessing @ses->ipc:
kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x36/0x90 ? exc_general_protection+0x1c1/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? __list_del_entry_valid_or_report+0x33/0xf0 __cifs_put_smb_ses+0x1ae/0x500 [cifs] smb2_reconnect_server+0x4ed/0x710 [cifs] process_one_work+0x205/0x6b0 worker_thread+0x191/0x360 ? __pfx_worker_thread+0x10/0x10 kthread+0xe2/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
AnalysisAI
Use-after-free memory corruption in the Linux kernel's SMB/CIFS client (cifs module) is triggered when the smb2_reconnect_server() worker accesses an SMB session that is concurrently being torn down by __cifs_put_smb_ses(), producing a kernel general-protection fault (poison pointer 0x6b6b...). It affects the CIFS client in kernel 6.9 release candidates and was resolved upstream by unconditionally setting the session status to SES_EXITING to close the race window. No public exploit identified at time of analysis, EPSS is low (0.23%), and it is not on CISA KEV; realistic impact is a kernel crash on hosts that actively mount SMB shares against a server that drops and re-establishes connections.
Technical ContextAI
The flaw lives in the in-kernel SMB2/3 client (fs/smb/client, the cifs module), which maintains per-mount session objects (struct cifs_ses) whose lifecycle is tracked by a ses_status field and reference counting. The root cause is CWE-416 (Use After Free): a time-of-check/time-of-use race between the cifsiod workqueue routine smb2_reconnect_server() and __cifs_put_smb_ses(), where the reconnect worker walks the session list and dereferences a session (e.g. @ses->ipc) after another thread has begun freeing it. The condition arises specifically when the client has a connection but no active session, or when a competing thread resets ses_status away from SES_EXITING, allowing the freed object (SLAB poison 0x6b6b6b6b6b6b6b6b) to be re-traversed via __list_del_entry_valid_or_report, causing the observed GPF.
RemediationAI
Patch available per vendor advisory - apply the upstream stable-kernel fix that unconditionally sets ses_status to SES_EXITING during session teardown; the corrected code ships in the patched stable releases referenced by commits 24a9799aa8ef, 45f2beda1f1b, 6202996a1c18, and 755fe68cd4b5 at git.kernel.org, and via distro packages (Debian LTS advisory https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html and Ubuntu/Canonical kernel updates). Because the exact fixed release tag is not given in the input, take the patched kernel your distribution ships rather than an assumed version number and reboot into it. If immediate patching is not possible, the practical compensating control is to avoid or restrict use of the in-kernel cifs client: unmount SMB shares and disable automatic CIFS mounts on exposed hosts, or increase mount stability (avoid frequent server disconnect/reconnect and lower echo_interval churn) to shrink the race window - trade-off is loss of SMB connectivity or degraded resilience during server outages. Restrict which servers clients mount from to trusted, stable endpoints to reduce induced reconnect events.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today