Junglewise Threat Intelligence

CVE-2024-26870: Linux Kernel NFSv4.2 kernel panic in nfs4_listxattr

CVE-2024-26870 · Severity: medium · CVSS 5.5 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) implementation could allow a local user to crash the system. The issue occurs when the system incorrectly handles requests to list extended file attributes, leading to a kernel panic. This primarily impacts the availability of the affected server or workstation.

Technical details

A vulnerability in NFSv4.2 within the Linux kernel can trigger a 'kernel BUG' at mm/usercopy.c:102. The issue arises in nfs4_listxattr() when a call is made with a buffer size greater than zero, but preceding calls to generic_listxattr() or nfs4_listxattr_nfs4_label() consume the entire buffer. This results in a zero-size buffer being passed to nfs4_listxattr_nfs4_user(), triggering a usercopy abort and subsequent kernel panic (Oops). An attacker with local access can exploit this to cause a Denial of Service (DoS). The fix introduces a check to return an ERANGE error if the required buffer size exceeds the provided size.

Affected products

  • Linux Linux Kernel 5.9 to 5.10.213, 5.11 to 5.15.152, 5.16 to 6.1.82, 6.2 to 6.6.22, 6.7 to 6.7.10, 6.8 to 6.8.1

Timeline

  • 2024-04-17: advisory
  • 2024-02-28: patched: Initial fix in mainline kernel commit 251a658bbfceafb4d58c76b77682c8bf7bcfad65

References

Related threats