CVE-2024-50283

What it actually does

Use-after-free in ksmbd where ksmbd_user_session_put is invoked outside smb3_preauth_hash_rsp, freeing the session object before the hash response handler runs and leaving a dangling pointer in slab memory.

Why it matters to the business

SMB file-sharing services on Linux kernels can crash or allow remote code execution, interrupting shared storage access for applications and users; listed campaigns indicate active interest from espionage and financially motivated actors despite low EPSS.

How an attack unfolds

An attacker establishes an SMB3 connection to a vulnerable ksmbd instance, issues pre-authentication requests that reach smb3_preauth_hash_rsp, forces the session to be freed at the wrong time, then reuses the dangling pointer to corrupt kernel memory or redirect execution, consistent with patterns seen in 2024 zero-day campaigns by espionage and financially motivated actors.

How to fix it

Apply the kernel fix that moves ksmbd_user_session_put inside smb3_preauth_hash_rsp; for the listed flashplugin-nonfree package on Ubuntu 14.04 LTS upgrade to version 11.2.202.554ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the patch is present by inspecting the ksmbd source for the corrected call ordering under smb3_preauth_hash_rsp and verify no slab-use-after-free reports in kernel logs after SMB3 preauth traffic.

Typical attack path

1. Connect to ksmbd over SMB3
2. Send crafted pre-authentication packets
3. Trigger premature ksmbd_user_session_put
4. Reuse freed session object in smb3_preauth_hash_rsp
5. Corrupt slab memory or achieve code execution

How to detect it

Inspect kernel logs and audit records for ksmbd session put operations occurring outside smb3_preauth_hash_rsp; correlate with SMB3 preauth traffic and slab allocator warnings; review activity from listed threat actors exploiting similar Linux kernel memory issues.

What your security team should do

• Prioritize kernel updates on all systems exposing ksmbd
• Disable ksmbd if SMB sharing is not required
• Monitor for related use-after-free patterns in kernel logs
• Review exposure of any downstream dependents of affected kernels