Riskcovery

CVE-2024-50120

smb: client: Handle kstrdup failures for passwords

State
Published
Severity
Not scored
Published
Nov 5, 2024
Updated
May 23, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Handle kstrdup failures for passwords

In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures.

If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7e8cffa4f85e6839335d75e6b47f918d90c1d194 to before 35dbac8c328d6afe937cd45ecd41d209d0b9f8b8Affected
  • c1eb537bf4560b3ad4df606c266c665624f3b502 to before 35488799b0ab6e4327f82e1d9209a60805665b37Affected
  • c1eb537bf4560b3ad4df606c266c665624f3b502 to before 9a5dd61151399ad5a5d69aad28ab164734c1e3bcAffected
  • e78308a6dcab1e53b38b8dd952e69c515cd324d7Affected
  • 2a0fc63f1f4fccfeb367d0c57b8a243cec60c26cAffected
  • 6.6.24 to before 6.6.59Affected
  • 6.7.12 to before 6.8Affected
  • 6.8.3 to before 6.9Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.6.59 through 6.6.*Not affected
  • 6.11.6 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.