Detections
Analytics

Echo: linux: security update to 6.12.3-1

high Tenable Self-Hosted Container Security Plugin ID 461546

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of
 signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts
 which occurs due to following race: task A task B cifs_mount() dfs_mount_share() get_session()
 cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session()
 smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Fix this by
 ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or
 SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in
 smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid
 ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.
 (CVE-2024-53179)

Solution

Update the linux library and its related packages to version 6.12.3-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-53179

Plugin Details

Severity: High

ID: 461546

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-53179

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 12/27/2024

Reference Information

CVE: CVE-2024-53179