CVE-2024-54680 (GCVE-0-2024-54680)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:35 – Updated: 2025-04-02 15:20
VLAI?

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-04-02T15:20:35.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-54680",
    "datePublished": "2025-01-11T12:35:43.170Z",
    "dateRejected": "2025-04-02T15:20:35.748Z",
    "dateReserved": "2025-01-11T12:33:33.715Z",
    "dateUpdated": "2025-04-02T15:20:35.748Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix TCP timers deadlock after rmmod\\n\\nCommit ef7134c7fc48 (\\\"smb: client: Fix use-after-free of network namespace.\\\")\\nfixed a netns UAF by manually enabled socket refcounting\\n(sk-\u003esk_net_refcnt=1 and sock_inuse_add(net, 1)).\\n\\nThe reason the patch worked for that bug was because we now hold\\nreferences to the netns (get_net_track() gets a ref internally)\\nand they\u0027re properly released (internally, on __sk_destruct()),\\nbut only because sk-\u003esk_net_refcnt was set.\\n\\nProblem:\\n(this happens regardless of CONFIG_NET_NS_REFCNT_TRACKER and regardless\\nif init_net or other)\\n\\nSetting sk-\u003esk_net_refcnt=1 *manually* and *after* socket creation is not\\nonly out of cifs scope, but also technically wrong -- it\u0027s set conditionally\\nbased on user (=1) vs kernel (=0) sockets.  And net/ implementations\\nseem to base their user vs kernel space operations on it.\\n\\ne.g. upon TCP socket close, the TCP timers are not cleared because\\nsk-\u003esk_net_refcnt=1:\\n(cf. commit 151c9c724d05 (\\\"tcp: properly terminate timers for kernel sockets\\\"))\\n\\nnet/ipv4/tcp.c:\\n    void tcp_close(struct sock *sk, long timeout)\\n    {\\n    \\tlock_sock(sk);\\n    \\t__tcp_close(sk, timeout);\\n    \\trelease_sock(sk);\\n    \\tif (!sk-\u003esk_net_refcnt)\\n    \\t\\tinet_csk_clear_xmit_timers_sync(sk);\\n    \\tsock_put(sk);\\n    }\\n\\nWhich will throw a lockdep warning and then, as expected, deadlock on\\ntcp_write_timer().\\n\\nA way to reproduce this is by running the reproducer from ef7134c7fc48\\nand then \u0027rmmod cifs\u0027.  A few seconds later, the deadlock/lockdep\\nwarning shows up.\\n\\nFix:\\nWe shouldn\u0027t mess with socket internals ourselves, so do not set\\nsk_net_refcnt manually.\\n\\nAlso change __sock_create() to sock_create_kern() for explicitness.\\n\\nAs for non-init_net network namespaces, we deal with it the best way\\nwe can -- hold an extra netns reference for server-\u003essocket and drop it\\nwhen it\u0027s released.  This ensures that the netns still exists whenever\\nwe need to create/destroy server-\u003essocket, but is not directly tied to\\nit.\"}]",
      "id": "CVE-2024-54680",
      "lastModified": "2025-01-11T13:15:27.340",
      "published": "2025-01-11T13:15:27.340",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/127e907e11ccd54b59bb78fc22c43ccb76c71079\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/906807c734ed219dcb2e7bbfde5c4168ed72a3d0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e9f2517a3e18a54a3943c098d2226b245d488801\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-54680\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:27.340\",\"lastModified\":\"2025-04-02T16:15:35.587\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-04-02T15:20:35.748Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-54680\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"REJECTED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2025-01-11T12:33:33.715Z\", \"datePublished\": \"2025-01-11T12:35:43.170Z\", \"dateUpdated\": \"2025-04-02T15:20:35.748Z\", \"dateRejected\": \"2025-04-02T15:20:35.748Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.