SB20241230199 - Improper locking in Linux kernel smb client

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper locking (CVE-ID: CVE-2024-53176)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cifs_dentry_needs_reval() function in fs/smb/client/inode.c, within the init_cifs() and cifs_destroy_netfs() functions in fs/smb/client/cifsfs.c, within the free_cached_dir(), close_all_cached_dirs(), invalidate_all_cached_dirs(), cached_dir_lease_break(), init_cached_dir(), cfids_laundromat_worker(), init_cached_dirs() and free_cached_dirs() functions in fs/smb/client/cached_dir.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3fa640d035e5ae526769615c35cb9ed4be6e3662
• https://git.kernel.org/stable/c/548812afd96982a76a93ba76c0582ea670c40d9e
• https://git.kernel.org/stable/c/73934e535cffbda1490fa97d82690a0f9aa73e94
• https://git.kernel.org/stable/c/ff4528bbc82d0d90073751f7b49e7b9e9c7e5638
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.11