CVE-2024-50120

What it actually does

Missing NULL checks after kstrdup calls for ctx->password and ctx->password2 in smb3_reconfigure allow use of uninitialized or NULL pointers on allocation failure, resulting in memory corruption or kernel oops.

Why it matters to the business

Local users on Linux systems using SMB3 client mounts can trigger denial of service via crashes under memory pressure; widespread kernel exposure increases operational risk for servers and endpoints handling network file shares.

How an attack unfolds

An attacker with local access induces memory pressure or manipulates SMB reconnection paths so that kstrdup fails inside smb3_reconfigure; the unchecked return values then cause NULL dereference or corruption, leading to kernel panic. Threat actor campaigns targeting Linux kernel memory issues provide context for potential future abuse.

How to fix it

Apply the upstream fix in commit e8f897f4afef0031fe618a8e94127a0934896aba or later; update to a kernel release containing this patch. Reboot after upgrade and verify SMB client functionality.

How to confirm the fix worked

Confirm presence of explicit -ENOMEM checks and NULL assignments after kstrdup for ses->password and ses->password2 in smb3_reconfigure; test under memory pressure to ensure graceful failure.

Typical attack path

1. Obtain local user or container access on affected Linux host
2. Trigger or wait for SMB3 session reconfiguration under constrained memory
3. Cause kstrdup failure for password buffers
4. Kernel follows NULL pointer leading to oops or corruption

How to detect it

Review kernel logs for oops or panic messages referencing smb3_reconfigure, kstrdup, or password handling in the CIFS/SMB module; correlate with local user activity on SMB mounts.

What your security team should do

• Prioritize kernel upgrade on all systems exposing SMB3 client mounts
• Monitor for local privilege-escalation or DoS attempts against SMB paths
• Apply within normal patch windows unless memory-exhaustion vectors are present