Junglewise Threat Intelligence

CVE-2024-47692: Linux Kernel nfsd null pointer dereference in nfs4_client_to_reclaim

CVE-2024-47692 · Severity: medium · CVSS 6.5 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow an attacker to crash the system. The issue occurs when the server processes specific client tracking information, particularly if the underlying database used for tracking clients becomes corrupted. This can lead to a system failure (kernel panic), resulting in a denial of service for users relying on the affected file server.

Technical details

A NULL pointer dereference vulnerability exists in the Linux kernel's nfsd component within the nfs4_client_to_reclaim() function. The root cause is a lack of validation for the 'namelen' variable when processing downcalls from the nfsdcld daemon. If a corrupted SQLite database in /var/lib/nfs/nfsdcld/ results in a namelen of 0, memdup_user() returns ZERO_SIZE_PTR (0x10). Subsequent access to name.data triggers a kernel panic. An attacker with the ability to influence the NFS client tracking database or trigger specific reclaim behaviors could exploit this to cause a denial of service. The issue has been patched by adding checks to return -EINVAL if namelen is zero in nfs4recover.c.

Affected products

  • Linux Linux kernel 5.2 to 5.10.226, 5.11 to 5.15.167, 5.16 to 6.1.112, 6.2 to 6.6.53, 6.7 to 6.10.12, 6.11 to 6.11.1

Timeline

  • 2024-09-03: other: Patch authored
  • 2024-10-21: advisory: CVE published

References

Related threats