Log in Start free

Vulnerability · Published Apr 17, 2024 · Assigned by Linux

CVE-2024-26822smb: client: set correct id, uid and cruid for multiuser automounts

High 8.7

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.164-1DSA-6163-1
Debian:12linux6.1.164-1DEBIAN-CVE-2024-26822
Debian:13linux6.7.7-1DEBIAN-CVE-2024-26822
Debian:14linux6.7.7-1DEBIAN-CVE-2024-26822
Ubuntu:22.04:LTSlinux5.15.0-130.140USN-7179-1
Ubuntu:22.04:LTSlinux5.15.0-130.140UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-aws5.15.0-1076.83UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-aws5.15.0-1076.83USN-7179-2
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-aws-6.56.5.0-1023.23~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure5.15.0-1078.87UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure5.15.0-1078.87USN-7186-2
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure-6.56.5.0-1024.25~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1078.87.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gcp5.15.0-1074.83USN-7179-2
Ubuntu:22.04:LTSlinux-gcp5.15.0-1074.83UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gcp-6.56.5.0-1024.26~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gke5.15.0-1072.78USN-7179-3
Ubuntu:22.04:LTSlinux-gke5.15.0-1072.78UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1057.64UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1057.64USN-7179-1
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-hwe-6.56.5.0-44.44~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-ibm5.15.0-1067.70UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-ibm5.15.0-1067.70USN-7179-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1071.77UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1071.77USN-7186-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1071.76UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-kvm5.15.0-1071.76USN-7179-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-128.138UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-128.138USN-7179-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.56.5.0-44.44.1~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1070.71UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1070.71USN-7179-2
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-nvidia-6.56.5.0-1023.24UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1032.32UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1020.20UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-oem-6.56.5.0-1027.28UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-oracle5.15.0-1073.79USN-7179-2
Ubuntu:22.04:LTSlinux-oracle5.15.0-1073.79UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-oracle-6.56.5.0-1026.26~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-raspi5.15.0-1070.73USN-7179-2
Ubuntu:22.04:LTSlinux-raspi5.15.0-1070.73UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-starfive-6.56.5.0-1017.18~22.04.1UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1041.45UBUNTU-CVE-2024-26822
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1041.45USN-7179-4

Affected products (as reported)

VendorProductVersions
Linux Linux c8117ac42303f7ae99bbe53e4952f7d147cca1fb – before 4a6e4c56721a3e6e2550b72ec56aab306c4607a760e3318e3e900ba1ddfead937012b3432dfccc92 – before 2ceba8ae1bd1f5589548cb722a5c583ca3a2dede9fd29a5bae6e8f94b410374099a6fddb253d2d5f – before c2aa2718cda2d56b4a551cb40043e9abc96846269fd29a5bae6e8f94b410374099a6fddb253d2d5f – before 7590ba9057c6d74c66f3b909a383ec47cd2f27fb9fd29a5bae6e8f94b410374099a6fddb253d2d5f – before 4508ec17357094e2075f334948393ddedbb751575.15.124 – before 5.15.2016.1.54 – before 6.1.164
Linux Linux 6.2

References