{"id":"CVE-2024-53179","title":"smb: client: fix use-after-free of signing key","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to followin…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 0944c2596c2a3442735b5bb6714a17a16188a68f","Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 39619c65ab4bbb3e78c818f537687653e112764d","Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591","Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 343d7fe6df9e247671440a932b6a73af4fa86d95","Linux 3.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-02-10T17:13:09.010478Z"},"published":"2024-12-27","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:20:09.698Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-53179","references":[{"url":"https://git.kernel.org/stable/c/0944c2596c2a3442735b5bb6714a17a16188a68f"},{"url":"https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d"},{"url":"https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591"},{"url":"https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95"}],"tags":["cve.org"],"epss":0.00617,"epssPercentile":0.49868,"ingestedAt":"2026-11-03T14:47:02.520Z","slug":"CVE-2024-53179","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A                         task B\ncifs_mount()\n dfs_mount_share()\n  get_session()\n   cifs_mount_get_session()    cifs_send_recv()\n    cifs_get_smb_ses()          compound_send_recv()\n     cifs_setup_session()        smb2_setup_request()\n      kfree_sensitive()           smb2_calc_signature()\n                                   crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses->auth_key.response by\nchecking whether @ses->ses_status is SES_GOOD or SES_EXITING with\n@ses->ses_lock held.  After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call ->logoff() only\nwhen @ses was known to be good (e.g. valid ->auth_key.response), so\nit's safe to access signing key when @ses->ses_status == SES_EXITING.\n\n## Affected\n\n- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 0944c2596c2a3442735b5bb6714a17a16188a68f`\n- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 39619c65ab4bbb3e78c818f537687653e112764d`\n- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591`\n- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 343d7fe6df9e247671440a932b6a73af4fa86d95`\n- `Linux 3.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}