Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-57895— ksmbd: set ATTR_CTIME flags when setting mtime

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在设置mtime时未设置ctime。

CVSS 7.1 · High EPSS 0.42% · P35

Possible ATT&CK Techniques 1 AI

T1562.001

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 0626e6641f6b467447c81dd7678a69c66f7746cf< c7ab587bd33ce45e2aa6b6d2d36be7ef0bd16614 affected
0626e6641f6b467447c81dd7678a69c66f7746cf< 1d7ee876b8b96efc14e177a7fe8d45ac25d68849 affected
0626e6641f6b467447c81dd7678a69c66f7746cf< 52cefcff6a4a814f4f8e357422fcfb71fd2ebf75 affected
0626e6641f6b467447c81dd7678a69c66f7746cf< 21e46a79bbe6c4e1aa73b3ed998130f2ff07b128 affected
5.15 affected
< 5.15 unaffected
6.1.164≤ 6.1.* unaffected
6.6.70≤ 6.6.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-57895

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: set ATTR_CTIME flags when setting mtime
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: set ATTR_CTIME flags when setting mtime David reported that the new warning from setattr_copy_mgtime is coming like the following. [ 113.215316] ------------[ cut here ]------------ [ 113.215974] WARNING: CPU: 1 PID: 31 at fs/attr.c:300 setattr_copy+0x1ee/0x200 [ 113.219192] CPU: 1 UID: 0 PID: 31 Comm: kworker/1:1 Not tainted 6.13.0-rc1+ #234 [ 113.220127] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 [ 113.221530] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 113.222220] RIP: 0010:setattr_copy+0x1ee/0x200 [ 113.222833] Code: 24 28 49 8b 44 24 30 48 89 53 58 89 43 6c 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 48 89 df e8 77 d6 ff ff e9 cd fe ff ff <0f> 0b e9 be fe ff ff 66 0 [ 113.225110] RSP: 0018:ffffaf218010fb68 EFLAGS: 00010202 [ 113.225765] RAX: 0000000000000120 RBX: ffffa446815f8568 RCX: 0000000000000003 [ 113.226667] RDX: ffffaf218010fd38 RSI: ffffa446815f8568 RDI: ffffffff94eb03a0 [ 113.227531] RBP: ffffaf218010fb90 R08: 0000001a251e217d R09: 00000000675259fa [ 113.228426] R10: 0000000002ba8a6d R11: ffffa4468196c7a8 R12: ffffaf218010fd38 [ 113.229304] R13: 0000000000000120 R14: ffffffff94eb03a0 R15: 0000000000000000 [ 113.230210] FS: 0000000000000000(0000) GS:ffffa44739d00000(0000) knlGS:0000000000000000 [ 113.231215] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.232055] CR2: 00007efe0053d27e CR3: 000000000331a000 CR4: 00000000000006b0 [ 113.232926] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 113.233812] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 113.234797] Call Trace: [ 113.235116] <TASK> [ 113.235393] ? __warn+0x73/0xd0 [ 113.235802] ? setattr_copy+0x1ee/0x200 [ 113.236299] ? report_bug+0xf3/0x1e0 [ 113.236757] ? handle_bug+0x4d/0x90 [ 113.237202] ? exc_invalid_op+0x13/0x60 [ 113.237689] ? asm_exc_invalid_op+0x16/0x20 [ 113.238185] ? setattr_copy+0x1ee/0x200 [ 113.238692] btrfs_setattr+0x80/0x820 [btrfs] [ 113.239285] ? get_stack_info_noinstr+0x12/0xf0 [ 113.239857] ? __module_address+0x22/0xa0 [ 113.240368] ? handle_ksmbd_work+0x6e/0x460 [ksmbd] [ 113.240993] ? __module_text_address+0x9/0x50 [ 113.241545] ? __module_address+0x22/0xa0 [ 113.242033] ? unwind_next_frame+0x10e/0x920 [ 113.242600] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 113.243268] notify_change+0x2c2/0x4e0 [ 113.243746] ? stack_depot_save_flags+0x27/0x730 [ 113.244339] ? set_file_basic_info+0x130/0x2b0 [ksmbd] [ 113.244993] set_file_basic_info+0x130/0x2b0 [ksmbd] [ 113.245613] ? process_scheduled_works+0xbe/0x310 [ 113.246181] ? worker_thread+0x100/0x240 [ 113.246696] ? kthread+0xc8/0x100 [ 113.247126] ? ret_from_fork+0x2b/0x40 [ 113.247606] ? ret_from_fork_asm+0x1a/0x30 [ 113.248132] smb2_set_info+0x63f/0xa70 [ksmbd] ksmbd is trying to set the atime and mtime via notify_change without also setting the ctime. so This patch add ATTR_CTIME flags when setting mtime to avoid a warning.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在设置mtime时未设置ctime。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0626e6641f6b467447c81dd7678a69c66f7746cf ~ c7ab587bd33ce45e2aa6b6d2d36be7ef0bd16614 -
Linux Linux 5.15 -

II. Public POCs for CVE-2024-57895

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-57895

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-57895 (3)

Same Patch Batch · Linux · 2025-01-15 · 32 CVEs total

CVE-2024-57882 9.8 CRITICAL mptcp: fix TCP options overflow.
CVE-2024-36476 9.8 CRITICAL RDMA/rtrs: Ensure 'ib_sge list' is accessible
CVE-2024-57802 9.4 CRITICAL netrom: check buffer length before accessing it
CVE-2025-21629 8.2 HIGH net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
CVE-2024-57883 7.8 HIGH mm: hugetlb: independent PMD page table shared count
CVE-2024-57857 7.8 HIGH RDMA/siw: Remove direct link to net_device
CVE-2024-57801 7.8 HIGH net/mlx5e: Skip restore TC rules for vport rep without loaded flag
CVE-2024-57795 7.8 HIGH RDMA/rxe: Remove the direct link to net_device
CVE-2024-39282 7.8 HIGH net: wwan: t7xx: Fix FSM command timeout issue
CVE-2024-57896 7.8 HIGH btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
CVE-2024-57893 7.8 HIGH ALSA: seq: oss: Fix races at processing SysEx messages
CVE-2024-57887 7.8 HIGH drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
CVE-2024-57899 7.6 HIGH wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
CVE-2024-57902 7.3 HIGH af_packet: fix vlan_get_tci() vs MSG_PEEK
CVE-2024-57901 7.3 HIGH af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
CVE-2024-57889 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
CVE-2024-57884 mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
CVE-2024-57844 drm/xe: Fix fault on fd close after unbind
CVE-2024-57841 net: fix memory leak in tcp_conn_request()
CVE-2024-57885 mm/kmemleak: fix sleeping function called from invalid context at print message

Showing top 20 of 32 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-57895

No comments yet

Leave a comment