CVE-2024-35999: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35999 is a vulnerability discovered in the Linux kernel's SMB3 implementation, specifically related to a missing lock condition when picking channels. The issue was identified on May 20, 2024, through Coverity scan analysis which detected a data race condition in the channel lock mechanism (NVD).

The vulnerability stems from a missing lock when accessing the session channel index in the SMB3 implementation. Specifically, the issue occurs in the cifs_pick_channel function within the kernel's SMB client transport code, where the channel lock should have been held while accessing the session channel index. This was identified by Coverity scan with ID 1582039 as a "Data race condition (MISSING_LOCK)" issue. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could potentially lead to a data race condition in the Linux kernel's SMB3 implementation, which might affect system stability and availability. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there could be a high impact on availability of the system (CISA-ADP).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation. The attack vector is local (AV:L), indicating that the attacker needs local access to the system to exploit this vulnerability (CISA-ADP).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released patches for multiple versions including Ubuntu 24.04 LTS (linux-image-6.8.0-40-lowlatency version 6.8.0-40.40.1) and other affected versions. The fix involves properly maintaining the channel lock when accessing the session channel index (Ubuntu Security).