CVE-2024-50043 nfsd: fix possible badness in FREE_STATEID
A race condition in the Linux kernel's NFS server allows attackers to trigger use-after-free or refcount underflow errors, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50043?
CVE-2024-50043 is a critical use after free vulnerability in Linux kernel, published on 21 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix possible badness in FREE_STATEID
When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors.
In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter.
Weakness: CWE-416
Which versions are affected by CVE-2024-50043?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50043?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-50043 being exploited?
There is no known exploitation of CVE-2024-50043 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-50043, DEBIAN-CVE-2024-50043, GHSA-5q55-gh5r-h286, UBUNTU-CVE-2024-50043.