PT-2024-33985 · Linux+5 · Linux Kernel+5
Published
2024-10-15
·
Updated
2025-10-03
·
CVE-2024-50152
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
A double free vulnerability has been resolved in the Linux kernel's SMB client. The issue occurs when the
ea variable is initialized to NULL, followed by a successful memory allocation, and then a failure that leads to a goto statement, resulting in a double free. The Clang static checker warned about an attempt to free released memory in the smb2ops.c file. Re-initializing the ea variable to NULL near the replay again label can fix this issue.Recommendations:
For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the double free vulnerability in the SMB client.
As a temporary workaround, consider re-initializing the
ea variable to NULL near the replay again label to prevent the double free issue.Exploit
Fix
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu