CVE-2024-46682 nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
A local attacker can cause a kernel panic by reading NFS state files, leading to a denial of service on the Linux NFS server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46682?
CVE-2024-46682 is a medium-severity vulnerability in Linux kernel, published on 13 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of sc_type") states_show() relied on sc_type field to be of valid type before calling into a subfunction to show content of a particular stateid. From that commit, we split the validity of the stateid into sc_status and no longer changed sc_type to 0 while unhashing the stateid. This resulted in kernel oopsing for nfsv4.0 opens that stay around and in nfs4_show_open() would derefence sc_file which was NULL.
Instead, for closed open stateids forgo displaying information that relies of having a valid sc_file.
To reproduce: mount the server with 4.0, read and close a file and then on the server cat /proc/fs/nfsd/clients/2/states
[ 513.590804] Call trace: [ 513.590925] _raw_spin_lock+0xcc/0x160 [ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] [ 513.591412] states_show+0x44c/0x488 [nfsd] [ 513.591681] seq_read_iter+0x5d8/0x760 [ 513.591896] seq_read+0x188/0x208 [ 513.592075] vfs_read+0x148/0x470 [ 513.592241] ksys_read+0xcc/0x178
Weakness: CWE-476
Which versions are affected by CVE-2024-46682?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46682?
Apply the vendor's patch.
Is CVE-2024-46682 being exploited?
There is no known exploitation of CVE-2024-46682 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-46682, DEBIAN-CVE-2024-46682, GHSA-xrjv-8x73-5h7v, UBUNTU-CVE-2024-46682.