CVE-2024-35882 SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
A memory leak in the Linux kernel's SUNRPC module allows attackers to exhaust server memory, causing denial of service on NFS servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35882?
CVE-2024-35882 is a high-severity denial of service vulnerability in Linux kernel, published on 19 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP
Jan Schunk reports that his small NFS servers suffer from memory exhaustion after just a few days. A bisect shows that commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") is the first bad commit.
That commit assumed that sock_sendmsg() releases all the pages in the underlying bio_vec array, but the reality is that it doesn't. svc_xprt_release() releases the rqst's response pages, but the record marker page fragment isn't one of those, so it is never released.
This is a narrow fix that can be applied to stable kernels. A more extensive fix is in the works.
Weakness: CWE-401
Which versions are affected by CVE-2024-35882?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35882?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-35882 being exploited?
There is no known exploitation of CVE-2024-35882 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-35882, DEBIAN-CVE-2024-35882, GHSA-96rq-8hwj-wwwm, UBUNTU-CVE-2024-35882.