CVE-2024-50152 (GCVE-0-2024-50152)

Vulnerability from cvelistv5 – Published: 2024-11-07 09:31 – Updated: 2026-08-05 11:42
VLAI
Title
smb: client: fix possible double free in smb2_set_ea()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfree(ea); | ^~~~~~~~~ There is a double free in such case: 'ea is initialized to NULL' -> 'first successful memory allocation for ea' -> 'something failed, goto sea_exit' -> 'first memory release for ea' -> 'goto replay_again' -> 'second goto sea_exit before allocate memory for ea' -> 'second memory release for ea resulted in double free'. Re-initialie 'ea' to NULL near to the replay_again label, it can fix this double free problem.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 433042a91f9373241307725b52de573933ffedbf , < b1813c220b76f60b1727984794377c4aa849d4c1 (git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < c9f758ecf2562dfdd4adf12c22921b5de8366123 (git)
Affected: 4f1fffa2376922f3d1d506e49c0fd445b023a28e , < 19ebc1e6cab334a8193398d4152deb76019b5d34 (git)
Affected: 6.6.32 , < 6.6.59 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.6.59 , ≤ 6.6.* (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1813c220b76f60b1727984794377c4aa849d4c1",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "c9f758ecf2562dfdd4adf12c22921b5de8366123",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "19ebc1e6cab334a8193398d4152deb76019b5d34",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.59",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix possible double free in smb2_set_ea()\n\nClang static checker(scan-build) warning\uff1a\nfs/smb/client/smb2ops.c:1304:2: Attempt to free released memory.\n 1304 |         kfree(ea);\n      |         ^~~~~~~~~\n\nThere is a double free in such case:\n\u0027ea is initialized to NULL\u0027 -\u003e \u0027first successful memory allocation for\nea\u0027 -\u003e \u0027something failed, goto sea_exit\u0027 -\u003e \u0027first memory release for ea\u0027\n-\u003e \u0027goto replay_again\u0027 -\u003e \u0027second goto sea_exit before allocate memory\nfor ea\u0027 -\u003e \u0027second memory release for ea resulted in double free\u0027.\n\nRe-initialie \u0027ea\u0027 to NULL near to the replay_again label, it can fix this\ndouble free problem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is driven entirely by data from a remote SMB peer over TCP/445 \u2014 the server induces the replay by resetting the connection (`-EAGAIN`) and then returns `STATUS_NO_EAS_ON_FILE`/an oversized `OutputBufferLength` to force the early `sea_exit` on the retry. A compromised file server or an on-path attacker spoofing SMB responses reaches it with no local access.\nAC:L - The malicious server deterministically controls both halves of the sequence \u2014 dropping the TCP connection mid-request and crafting the QUERY_INFO reply on the replay \u2014 needing only two round trips, with no race or memory-layout condition outside its control. Mounted shares see routine xattr traffic from backup, archive, and desktop-metadata tooling.\nPR:N - A malicious or compromised SMB server holds no privileges whatsoever on the victim client, and nothing on the code path checks server trust. Even in a purely local framing, only ordinary write access to a file on the share is needed.\nUI:N - No victim action is required at exploitation time \u2014 the mount is already established via fstab/autofs/systemd, and the setxattr/removexattr that enters `smb2_set_ea()` is generated by ordinary background activity such as `rsync -X`, `cp -a`, `tar --xattrs`, or indexing daemons.\nS:U - The double free corrupts the kernel slab allocator within the same security authority as the vulnerable code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The second `kfree()` releases a chunk that has almost certainly been reallocated to another live kernel object, producing a use-after-free with two owners; the attacker-chosen allocation size enables grooming into a targeted kmalloc cache and reading back arbitrary kernel data.\nI:H - Double-free/UAF of an attacker-sized slab object is the canonical primitive for heap spraying and controlled overwrite of an adjacent or aliased structure, giving arbitrary write and control-flow hijack potential.\nA:H - Even unexploited, the double free triggers slab freelist corruption or an immediate `BUG()` under `CONFIG_SLAB_FREELIST_HARDENED`, causing a kernel oops/panic that is remotely and repeatably inducible by the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:06.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1813c220b76f60b1727984794377c4aa849d4c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9f758ecf2562dfdd4adf12c22921b5de8366123"
        },
        {
          "url": "https://git.kernel.org/stable/c/19ebc1e6cab334a8193398d4152deb76019b5d34"
        }
      ],
      "title": "smb: client: fix possible double free in smb2_set_ea()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50152",
    "datePublished": "2024-11-07T09:31:28.733Z",
    "dateReserved": "2024-10-21T19:36:19.959Z",
    "dateUpdated": "2026-08-05T11:42:06.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50152",
      "date": "2026-09-27",
      "epss": "0.00481",
      "percentile": "0.39054"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b1813c220b76f60b1727984794377c4aa849d4c1",
                    "status": "affected",
                    "version": "433042a91f9373241307725b52de573933ffedbf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9f758ecf2562dfdd4adf12c22921b5de8366123",
                    "status": "affected",
                    "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19ebc1e6cab334a8193398d4152deb76019b5d34",
                    "status": "affected",
                    "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.59",
                    "status": "affected",
                    "version": "6.6.32",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/smb2ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15752D93-7E64-45C3-AA2D-6A544F5E615F",
                    "versionEndExcluding": "6.6.59",
                    "versionStartIncluding": "6.6.32",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2CAA29A6-36B4-4C90-A862-A816F65153DB",
                    "versionEndExcluding": "6.11.6",
                    "versionStartIncluding": "6.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix possible double free in smb2_set_ea()\n\nClang static checker(scan-build) warning\uff1a\nfs/smb/client/smb2ops.c:1304:2: Attempt to free released memory.\n 1304 |         kfree(ea);\n      |         ^~~~~~~~~\n\nThere is a double free in such case:\n\u0027ea is initialized to NULL\u0027 -\u003e \u0027first successful memory allocation for\nea\u0027 -\u003e \u0027something failed, goto sea_exit\u0027 -\u003e \u0027first memory release for ea\u0027\n-\u003e \u0027goto replay_again\u0027 -\u003e \u0027second goto sea_exit before allocate memory\nfor ea\u0027 -\u003e \u0027second memory release for ea resulted in double free\u0027.\n\nRe-initialie \u0027ea\u0027 to NULL near to the replay_again label, it can fix this\ndouble free problem."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: se corrige una posible doble liberaci\u00f3n en smb2_set_ea() Advertencia del comprobador est\u00e1tico de Clang (scan-build): fs/smb/client/smb2ops.c:1304:2: Intento de liberar memoria liberada. 1304 | kfree(ea); | ^~~~~~~~~ Hay una doble liberaci\u00f3n en tal caso: \u0027ea se inicializa a NULL\u0027 -\u0026gt; \u0027primera asignaci\u00f3n de memoria exitosa para ea\u0027 -\u0026gt; \u0027algo fall\u00f3, goto sea_exit\u0027 -\u0026gt; \u0027primera liberaci\u00f3n de memoria para ea\u0027 -\u0026gt; \u0027goto replay_again\u0027 -\u0026gt; \u0027segundo goto sea_exit antes de asignar memoria para ea\u0027 -\u0026gt; \u0027la segunda liberaci\u00f3n de memoria para ea result\u00f3 en una doble liberaci\u00f3n\u0027. Reinicialice \u0027ea\u0027 a NULL cerca de la etiqueta replay_again, puede solucionar este problema de doble liberaci\u00f3n."
          }
        ],
        "id": "CVE-2024-50152",
        "lastModified": "2026-08-04T11:21:26.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-11-07T10:15:06.850",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/19ebc1e6cab334a8193398d4152deb76019b5d34"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b1813c220b76f60b1727984794377c4aa849d4c1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c9f758ecf2562dfdd4adf12c22921b5de8366123"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:18:37+00:00",
      "cve": "CVE-2024-50152",
      "id": "CVE-2024-50152",
      "initial_release_date": "2024-11-07T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix possible double free in smb2_set_ea()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50152.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.