CVE-2024-50152

What it actually does

Double free in smb2_set_ea() when ea pointer is freed on error path, replay_again label is reached without resetting ea to NULL, and sea_exit is taken a second time before reallocation.

Why it matters to the business

Linux systems using SMB clients face risk of kernel memory corruption leading to crashes or potential privilege escalation; high prevalence of Linux kernels increases exposure across servers and endpoints.

How an attack unfolds

Attacker initiates SMB2 set extended attributes operation that succeeds on first allocation but fails later, triggering goto sea_exit then replay_again; failure to re-initialize ea allows second free on replay exit path resulting in use-after-free.

How to fix it

Update Linux kernel to version 6.6.59 or later; apply equivalent fixes in distribution backports for affected SMB client code in fs/smb/client/smb2ops.c.

How to confirm the fix worked

Confirm running kernel version meets or exceeds 6.6.59; inspect smb2ops.c around line 1304 to verify ea=NULL assignment before replay_again label; test SMB EA operations under error injection.

Typical attack path

1. Establish SMB connection to target
2. Issue SMB2 SET_INFO with extended attributes
3. Force allocation success followed by subsequent failure condition
4. Trigger replay_again label via transport or session error
5. Reach sea_exit second time causing double kfree

How to detect it

Search kernel logs and dmesg for double-free warnings or oops referencing smb2ops.c and kfree(ea); correlate with SMB2 SET_INFO traffic and replay events; review audit logs for unexpected EA attribute changes by non-admin processes.

What your security team should do

• Prioritize kernel upgrades on all SMB client systems within patch windows
• Enable kernel memory debugging and panic-on-oops in test environments to surface double-free crashes
• Restrict untrusted SMB shares and monitor for unusual EA operations
• Review downstream dependents for delayed updates given ecosystem prevalence