Junglewise Threat Intelligence

CVE-2024-50121: Linux Kernel NFSD use-after-free in nfs4_state_shutdown_net

CVE-2024-50121 · Severity: high · CVSS 7.8 · Published 2024-11-05

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a local attacker to cause a system crash or potentially execute unauthorized actions. The issue occurs when the system shuts down NFS services while certain background maintenance tasks are still running, leading to memory corruption. This could result in a loss of system availability or unauthorized access to sensitive data.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's NFSD (NFS server) implementation within the nfs4_state_shutdown_net function. The root cause is a race condition where nfsd_shrinker_work is cancelled using non-synchronous mode (cancel_work) instead of synchronous mode (cancel_work_sync). If the nfsd_client_shrinker is running concurrently during service shutdown (e.g., when reducing thread counts to zero), it may attempt to access or destroy nfs4_client objects and associated file cache slabs after they have already been released by the shutdown process. This leads to 'objects remaining' warnings in kmem_cache_shutdown and subsequent UAF errors. The vulnerability is reachable by a local user with sufficient privileges to modify NFSD thread settings via /proc/fs/nfsd/threads.

Affected products

  • Linux Linux Kernel 5.10.220 to 5.15, 5.15.154 to 6.1, 6.2 to 6.6.59, 6.7 to 6.11.6, 6.12-rc1 to 6.12-rc4

Timeline

  • 2024-10-21: other: Patch submitted by developer
  • 2024-11-05: advisory: CVE published

References

Related threats