Junglewise Threat Intelligence

CVE-2024-50046: Linux Kernel NULL pointer dereference in NFSv4 nfs42_complete_copies

CVE-2024-50046 · Severity: medium · CVSS 5.5 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's NFSv4 client implementation can cause a system crash (kernel panic) when performing file copy operations between locations on the same NFS server. This occurs due to a technical error during state recovery, leading to a complete denial of service for the affected machine. While it does not directly expose data, it can disrupt business operations and server availability.

Technical details

A NULL-pointer dereference vulnerability exists in the NFSv4 client component of the Linux kernel, specifically within the nfs42_complete_copies() function. The issue is triggered when an NFS client attempts to copy files between different locations on the same NFS server and encounters a state recovery failure (e.g., error -116). During this process, the kernel attempts to access a memory address through a NULL pointer, resulting in an 'Oops' and system crash. The vulnerability is classified as CWE-476. Patches have been released across multiple stable kernel branches (e.g., 5.15.y, 6.1.y, 6.6.y) to ensure proper pointer validation before access.

Affected products

  • Linux Linux Kernel 5.15.131-9 and other versions prior to fix

Timeline

  • 2024-10-01: patched: Initial fix authored by Yanjun Zhang
  • 2024-10-21: advisory: CVE-2024-50046 published

References

Related threats