Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) component could allow a local user to cause a system warning or instability. The issue occurs when the system fails to properly handle errors during the initialization of network namespaces, a feature used to isolate network environments. While primarily resulting in kernel warnings during cleanup, such flaws can sometimes be leveraged to impact system availability.
Technical details
A flaw exists in the nfs_net_init() function within the Linux kernel's NFS implementation. The root cause is the failure to check the return value of rpc_proc_register(). If this registration fails, nfs_net_init() incorrectly returns success. Consequently, when the network namespace (netns) is later destroyed, nfs_net_exit() attempts to call rpc_proc_unregister(), which triggers a warning in remove_proc_entry() because it tries to remove a non-existent proc directory entry. This issue was made more visible by recent changes that converted procfs to be per-network namespace. Patches have been released for various stable kernel branches (e.g., 6.8.10, 6.6.31, 6.1.91).
Affected products
- Linux Linux Kernel 2.6.12 to 6.8.10
Timeline
- 2024-04-04: patched: Initial fix committed to mainline kernel
- 2024-05-30: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/24457f1be29f1e7042e50a7749f5c2dde8c433c8
- https://git.kernel.org/stable/c/8a1f89c98dcc542dd6d287e573523714702e0f9c
- https://git.kernel.org/stable/c/8ae63bd858691bee0e2a92571f2fbb36a4d86d65
- https://git.kernel.org/stable/c/9909dde2e53a19585212c32fe3eda482b5faaaa3
- https://git.kernel.org/stable/c/b33ca18c3a1190208dfd569c4fa8a2f93084709f
- https://git.kernel.org/stable/c/d4891d817350c67392d4731536945f3809a2a0ba
- https://git.kernel.org/stable/c/ea6ce93327bd2c8a0c6cf6f2f0e800f3b778f021