CVE-2024-50152
MEDIUM EPSS 11.8%
Published Nov 7, 20241y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published Nov 7, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfree(ea); | ^~~~~~~~~ There is a double free in such case: 'ea is initialized to NULL' -> 'first successful memory allocation for ea' -> 'something failed, goto sea_exit' -> 'first memory release for ea' -> 'goto replay_again' -> 'second goto sea_exit before allocate memory for ea' -> 'second memory release for ea resulted in double free'. Re-initialie 'ea' to NULL near to the replay_again label, it can fix this double free problem.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
11.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-415
Affected Products 5
References 3
- git.kernel.org https://git.kernel.org/stable/c/19ebc1e6cab334a8193398d4152deb76019b5d34
- git.kernel.org https://git.kernel.org/stable/c/b1813c220b76f60b1727984794377c4aa849d4c1
- git.kernel.org https://git.kernel.org/stable/c/c9f758ecf2562dfdd4adf12c22921b5de8366123
Remediation
- git.kernel.org https://git.kernel.org/stable/c/19ebc1e6cab334a8193398d4152deb76019b5d34
- git.kernel.org https://git.kernel.org/stable/c/b1813c220b76f60b1727984794377c4aa849d4c1
- git.kernel.org https://git.kernel.org/stable/c/c9f758ecf2562dfdd4adf12c22921b5de8366123