GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-54680 (GCVE-0-2024-54680)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:35 – Updated: 2025-04-02 15:20
VLAI

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-04-02T15:20:35.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-54680",
    "datePublished": "2025-01-11T12:35:43.170Z",
    "dateRejected": "2025-04-02T15:20:35.748Z",
    "dateReserved": "2025-01-11T12:33:33.715Z",
    "dateUpdated": "2025-04-02T15:20:35.748Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix TCP timers deadlock after rmmod\n\nCommit ef7134c7fc48 (\"smb: client: Fix use-after-free of network namespace.\")\nfixed a netns UAF by manually enabled socket refcounting\n(sk-\u003esk_net_refcnt=1 and sock_inuse_add(net, 1)).\n\nThe reason the patch worked for that bug was because we now hold\nreferences to the netns (get_net_track() gets a ref internally)\nand they\u0027re properly released (internally, on __sk_destruct()),\nbut only because sk-\u003esk_net_refcnt was set.\n\nProblem:\n(this happens regardless of CONFIG_NET_NS_REFCNT_TRACKER and regardless\nif init_net or other)\n\nSetting sk-\u003esk_net_refcnt=1 *manually* and *after* socket creation is not\nonly out of cifs scope, but also technically wrong -- it\u0027s set conditionally\nbased on user (=1) vs kernel (=0) sockets.  And net/ implementations\nseem to base their user vs kernel space operations on it.\n\ne.g. upon TCP socket close, the TCP timers are not cleared because\nsk-\u003esk_net_refcnt=1:\n(cf. commit 151c9c724d05 (\"tcp: properly terminate timers for kernel sockets\"))\n\nnet/ipv4/tcp.c:\n    void tcp_close(struct sock *sk, long timeout)\n    {\n    \tlock_sock(sk);\n    \t__tcp_close(sk, timeout);\n    \trelease_sock(sk);\n    \tif (!sk-\u003esk_net_refcnt)\n    \t\tinet_csk_clear_xmit_timers_sync(sk);\n    \tsock_put(sk);\n    }\n\nWhich will throw a lockdep warning and then, as expected, deadlock on\ntcp_write_timer().\n\nA way to reproduce this is by running the reproducer from ef7134c7fc48\nand then \u0027rmmod cifs\u0027.  A few seconds later, the deadlock/lockdep\nwarning shows up.\n\nFix:\nWe shouldn\u0027t mess with socket internals ourselves, so do not set\nsk_net_refcnt manually.\n\nAlso change __sock_create() to sock_create_kern() for explicitness.\n\nAs for non-init_net network namespaces, we deal with it the best way\nwe can -- hold an extra netns reference for server-\u003essocket and drop it\nwhen it\u0027s released.  This ensures that the netns still exists whenever\nwe need to create/destroy server-\u003essocket, but is not directly tied to\nit."
        }
      ],
      "id": "CVE-2024-54680",
      "lastModified": "2025-01-11T13:15:27.340",
      "published": "2025-01-11T13:15:27.340",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/127e907e11ccd54b59bb78fc22c43ccb76c71079"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/906807c734ed219dcb2e7bbfde5c4168ed72a3d0"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/e9f2517a3e18a54a3943c098d2226b245d488801"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:11:01.000Z",
      "cve": "CVE-2024-54680",
      "id": "msrc_CVE-2024-54680",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-54680.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
          }
        ],
        "id": "CVE-2024-54680",
        "lastModified": "2025-04-02T16:15:35.587",
        "metrics": {},
        "published": "2025-01-11T13:15:27.340",
        "references": [],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Rejected"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:12:50+00:00",
      "cve": "CVE-2024-54680",
      "id": "CVE-2024-54680",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: fix TCP timers deadlock after rmmod",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-54680.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:21:36Z",
      "cve": "CVE-2024-54680",
      "id": "CVE-2024-54680",
      "initial_release_date": "2025-01-12T00:15:26Z",
      "product_status:known_affected": "4",
      "product_status:known_not_affected": "292",
      "product_status:recommended": "565",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-54680",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-54680.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": {
        "cna": {
          "providerMetadata": {
            "dateUpdated": "2025-04-02T15:20:35.748Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "rejectedReasons": [
            {
              "lang": "en",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-54680",
        "datePublished": "2025-01-11T12:35:43.170Z",
        "dateRejected": "2025-04-02T15:20:35.748Z",
        "dateReserved": "2025-01-11T12:33:33.715Z",
        "dateUpdated": "2025-04-02T15:20:35.748Z",
        "state": "REJECTED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.