CVE-2024-50152

Summary

CVE-2024-50152 is a vulnerability affecting the Linux kernel's SMB (Server Message Block) client. The issue involves a double free problem in the function smb2_set_ea() within the file fs/smb/client/smb2ops.c. The vulnerability occurs when 'ea' is initialized to NULL, but later in the code, memory is allocated for 'ea', which is then released. If an error occurs and the code flow goes through a particular path, 'ea' is re-initialized to NULL, but the previously released memory is not reclaimed, leading to a double free situation. This can potentially result in memory corruption and other unintended consequences. To mitigate this issue, the code should be modified to properly re-initialize 'ea' to NULL near the replay_again label, preventing the double free condition.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.