CVE-2024-35999

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35999", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.149Z", "datePublished": "2024-05-20T09:48:01.653Z", "dateUpdated": "2026-08-05T11:31:30.660Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:30.660Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: missing lock when picking channel\n\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\n\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The race is driven by the remote SMB server over TCP/445 \u2014 channel invalidation happens in `cifs_chan_skip_or_disable()` and `cifs_decrease_secondary_channels()`, both reached from responses the server controls (dropping `SMB2_GLOBAL_CAP_MULTI_CHANNEL` on reconnect, changing the advertised interface list, or resetting a channel's connection). A malicious or compromised server, or an on-path attacker, can force channel teardown at will against a client with a multichannel mount.\nAC:L - The remote peer deterministically and repeatedly controls one side of the race by tearing down or re-advertising channels, while ongoing background I/O and writeback continuously call `cifs_pick_channel()` for the other side; the server can even force client requests via oplock/lease breaks. No unpredictable memory layout or victim state is required, and SMB3 multichannel is a widely deployed mount option rather than a rare config.\nPR:N - The attacker is the remote SMB peer or an on-path attacker and needs no account, credentials, or privileges on the victim client; the defect is hit during ordinary operation of an already-established session.\nUI:N - The multichannel CIFS mount is a pre-existing environmental condition (fstab/autofs/Azure Files), and at exploit time no deliberate victim action is needed \u2014 background writeback, echoes, and cached-dir refreshes reach `cifs_pick_channel()` on their own.\nS:U - The unsynchronized read and its effects are confined to the client kernel's own CIFS session and `TCP_Server_Info` structures within a single security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:N - `ses->chans[]` is a fixed-size in-struct array and `index` is bounded by `chan_count <= CIFS_MAX_CHANNELS`, so the racy load reads no out-of-bounds memory and yields no read primitive; the observable value is a NULL or unvalidated channel pointer, not disclosed kernel data.\nI:N - Nothing is written out of bounds and no file data or kernel object is modified \u2014 the defect only causes the wrong (or NULL) channel to be selected, and SMB signing/encryption still governs what is actually transmitted.\nA:H - The returned channel was never validated, so it can be NULL \u2014 propagating `-EIO`/`-ECONNABORTED` failures out of reads, writes, flushes and writeback across the whole mount \u2014 or a channel already marked `terminate`/`NEEDS_RECONNECT`, in which case requests are submitted on a dying connection and block until reconnect or timeout, wedging the mount. The remote server can retrigger this indefinitely."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/transport.c"], "versions": [{"version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "98c7ed29cd754ae7475dc7cb3f33399fda902729", "status": "affected", "versionType": "git"}, {"version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "0fcf7e219448e937681216353c9a58abae6d3c2e", "status": "affected", "versionType": "git"}, {"version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "60ab245292280905603bc0d3654f4cf8fceccb00", "status": "affected", "versionType": "git"}, {"version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "8094a600245e9b28eb36a13036f202ad67c1f887", "status": "affected", "versionType": "git"}, {"version": "3d74c2c917e4006a3bd660d2fc7829cb2ef64113", "status": "affected", "versionType": "git"}, {"version": "5.15.27", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/transport.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.91", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.30", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.9", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.27"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729"}, {"url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e"}, {"url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00"}, {"url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887"}], "title": "smb3: missing lock when picking channel", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-31T18:47:15.980890Z", "id": "CVE-2024-35999", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T20:01:44.554Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:13.189Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:13.189Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-31T18:47:15.980890Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-31T18:47:20.207Z"}}], "cna": {"title": "smb3: missing lock when picking channel", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The race is driven by the remote SMB server over TCP/445 \u2014 channel invalidation happens in `cifs_chan_skip_or_disable()` and `cifs_decrease_secondary_channels()`, both reached from responses the server controls (dropping `SMB2_GLOBAL_CAP_MULTI_CHANNEL` on reconnect, changing the advertised interface list, or resetting a channel's connection). A malicious or compromised server, or an on-path attacker, can force channel teardown at will against a client with a multichannel mount.\nAC:L - The remote peer deterministically and repeatedly controls one side of the race by tearing down or re-advertising channels, while ongoing background I/O and writeback continuously call `cifs_pick_channel()` for the other side; the server can even force client requests via oplock/lease breaks. No unpredictable memory layout or victim state is required, and SMB3 multichannel is a widely deployed mount option rather than a rare config.\nPR:N - The attacker is the remote SMB peer or an on-path attacker and needs no account, credentials, or privileges on the victim client; the defect is hit during ordinary operation of an already-established session.\nUI:N - The multichannel CIFS mount is a pre-existing environmental condition (fstab/autofs/Azure Files), and at exploit time no deliberate victim action is needed \u2014 background writeback, echoes, and cached-dir refreshes reach `cifs_pick_channel()` on their own.\nS:U - The unsynchronized read and its effects are confined to the client kernel's own CIFS session and `TCP_Server_Info` structures within a single security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:N - `ses->chans[]` is a fixed-size in-struct array and `index` is bounded by `chan_count <= CIFS_MAX_CHANNELS`, so the racy load reads no out-of-bounds memory and yields no read primitive; the observable value is a NULL or unvalidated channel pointer, not disclosed kernel data.\nI:N - Nothing is written out of bounds and no file data or kernel object is modified \u2014 the defect only causes the wrong (or NULL) channel to be selected, and SMB signing/encryption still governs what is actually transmitted.\nA:H - The returned channel was never validated, so it can be NULL \u2014 propagating `-EIO`/`-ECONNABORTED` failures out of reads, writes, flushes and writeback across the whole mount \u2014 or a channel already marked `terminate`/`NEEDS_RECONNECT`, in which case requests are submitted on a dying connection and block until reconnect or timeout, wedging the mount. The remote server can retrigger this indefinitely."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "98c7ed29cd754ae7475dc7cb3f33399fda902729", "versionType": "git"}, {"status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "0fcf7e219448e937681216353c9a58abae6d3c2e", "versionType": "git"}, {"status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "60ab245292280905603bc0d3654f4cf8fceccb00", "versionType": "git"}, {"status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "lessThan": "8094a600245e9b28eb36a13036f202ad67c1f887", "versionType": "git"}, {"status": "affected", "version": "3d74c2c917e4006a3bd660d2fc7829cb2ef64113", "versionType": "git"}, {"status": "affected", "version": "5.15.27", "lessThan": "5.16", "versionType": "semver"}], "programFiles": ["fs/smb/client/transport.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.91", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.30", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.9", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/transport.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729"}, {"url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e"}, {"url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00"}, {"url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: missing lock when picking channel\n\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\n\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.91", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.30", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.9", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.15.27"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:30.660Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35999", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:31:30.660Z", "dateReserved": "2024-05-17T13:50:33.149Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-20T09:48:01.653Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "98c7ed29cd754ae7475dc7cb3f33399fda902729", "status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "versionType": "git"}, {"lessThan": "0fcf7e219448e937681216353c9a58abae6d3c2e", "status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "versionType": "git"}, {"lessThan": "60ab245292280905603bc0d3654f4cf8fceccb00", "status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "versionType": "git"}, {"lessThan": "8094a600245e9b28eb36a13036f202ad67c1f887", "status": "affected", "version": "724244cdb3828522109c88e56a0242537aefabe9", "versionType": "git"}, {"status": "affected", "version": "3d74c2c917e4006a3bd660d2fc7829cb2ef64113", "versionType": "git"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.27", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.91", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.30", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7F044DD-06F0-44B2-8185-DCA23913A970", "versionEndExcluding": "6.1.91", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "84046DAF-73CF-429D-9BA4-05B658B377B5", "versionEndExcluding": "6.6.30", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F9041E5-8358-4EF7-8F98-B812EDE49612", "versionEndExcluding": "6.8.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*", "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: missing lock when picking channel\n\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\n\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")"}, {"lang": "es", "value": " En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb3: falta el bloqueo al seleccionar el canal. Coverity detect\u00f3 un lugar donde deber\u00edamos haber mantenido el bloqueo del canal al acceder al \u00edndice del canal ses. Direcciones-Cobertura: 1582039 (\"Condici\u00f3n de ejecuci\u00f3n de datos (MISSING_LOCK)\")"}], "id": "CVE-2024-35999", "lastModified": "2026-08-04T11:18:20.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35999", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-31T18:47:15.980890Z", "version": "2.0.3"}}]}, "published": "2024-05-20T10:15:14.100", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0fcf7e219448e937681216353c9a58abae6d3c2e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60ab245292280905603bc0d3654f4cf8fceccb00"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98c7ed29cd754ae7475dc7cb3f33399fda902729"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: smb3: missing lock when picking channel", "id": "2281972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281972"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb3: missing lock when picking channel\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")"], "name": "CVE-2024-35999", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35999\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35999\nhttps://lore.kernel.org/linux-cve-announce/2024052023-CVE-2024-35999-da29@gregkh/T"], "threat_severity": "Moderate"}

{}