Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s ksmbd SMB server mishandles file timestamp updates, triggering a kernel warning and potentially disrupting service. An authenticated network user with low privileges may be able to affect file metadata and availability. Systems not running or exposing ksmbd are unlikely to be directly exposed.
Executive priority
Prioritize affected, reachable ksmbd servers for prompt maintenance, especially business-critical file services. This is a high-severity availability risk, but the evidence does not show active exploitation. Systems without ksmbd exposure can follow normal patch scheduling after confirming their configuration.
Technical view
When ksmbd sets access and modification times through notify_change, it omits ATTR_CTIME. This violates setattr expectations and can trigger a warning in filesystem code, demonstrated with Btrfs. The supplied CVSS 3.1 score is 7.1, reflecting network reachability, low complexity, low privileges, limited integrity impact, and high availability impact.
Likely exposure
Exposure requires an affected Linux kernel with ksmbd enabled and reachable over the network. The CVSS vector indicates that exploitation requires low privileges but no user interaction. The supplied version information is ambiguous, so confirm exposure using the distribution’s kernel package guidance and the referenced stable commits.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as KEV in the bundle. It documents a reproducible kernel warning rather than a public attack chain. Treat internet-facing or broadly accessible ksmbd servers as higher priority because the vulnerability is network reachable and may affect availability.
Researcher notes
The corrective change adds ATTR_CTIME when ksmbd sets mtime. The report shows the path through smb2_set_info, set_file_basic_info, notify_change, and filesystem setattr handling. Evidence demonstrates a warning on Btrfs; the bundle does not establish broader crash behavior, exploit reliability, or specific attack prevalence.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix.
- Check Linux distribution advisories for the corrected package version.
- Disable ksmbd when SMB service is unnecessary.
- Restrict SMB access to trusted networks and authorized users until patched.
Validation and detection
- Inventory systems where ksmbd is installed, loaded, or enabled.
- Identify SMB listeners and verify whether untrusted networks can reach them.
- Compare running kernel builds with distribution advisories and referenced stable fixes.
- Review kernel logs for setattr_copy warnings involving ksmbd or set_file_basic_info.
- After updating, confirm the corrected kernel is running and SMB operations remain functional.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-57895 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H2.84.2LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c7ab587bd33ce45e2aa6b6d2d36be7ef0bd16614CVE reference, Linux
- https://git.kernel.org/stable/c/1d7ee876b8b96efc14e177a7fe8d45ac25d68849CVE reference, Linux
- https://git.kernel.org/stable/c/52cefcff6a4a814f4f8e357422fcfb71fd2ebf75CVE reference, Linux
- https://git.kernel.org/stable/c/21e46a79bbe6c4e1aa73b3ed998130f2ff07b128CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.