CVE-2024-50286

Summary

CVE-2024-50286 is a recently identified vulnerability in the Linux kernel. It affects the ksmbd component, specifically the function ksmbd_smb2_session_create. The issue stems from a race condition between this function and ksmbd_expire_session. As a result, when adding or deleting a session from the global session table, a use-after-free condition may occur, potentially allowing an attacker to execute arbitrary code with the privileges of the ksmbd daemon. The vulnerability has been addressed through the addition of a missing sessions_table_lock while performing these operations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.