CVE-2024-35914 (GCVE-0-2024-35914)
Vulnerability from cvelistv5
Published
2024-05-19 08:35
Modified
2026-08-05 11:30
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.
References
Impacted products
Vendor Product Version
Linux Linux Version: a8b0026847b8c43445c921ad2c85521c92eb175f
Version: a8b0026847b8c43445c921ad2c85521c92eb175f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T16:53:51.345113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T16:54:02.746Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "331e125e02c08ffaecc1074af78a988a278039bd",
              "status": "affected",
              "version": "a8b0026847b8c43445c921ad2c85521c92eb175f",
              "versionType": "git"
            },
            {
              "lessThan": "9fe6e9e7b58944037714442384075c17cfde1c56",
              "status": "affected",
              "version": "a8b0026847b8c43445c921ad2c85521c92eb175f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached purely by sending an NFSv2/v3 RENAME RPC or an NFSv4 COMPOUND containing RENAME over TCP/2049. No local access to the server is needed.\nAC:L - The remote client supplies both directory filehandles itself and can retry the request an unbounded number of times; nfsd explicitly tolerates DCACHE_DISCONNECTED directory dentries (it only warns), so the lock_rename() -EXDEV bail-out is reachable from client-controlled input rather than depending on a condition the attacker cannot influence.\nPR:N - With the standard AUTH_SYS/AUTH_UNIX export configuration nfsd performs no cryptographic authentication \u2014 the client asserts its own uid/gid, so the fh_verify() NFSD_MAY_REMOVE/NFSD_MAY_CREATE checks are satisfied by a self-declared identity. Any host permitted by the export list can trigger it with no privileges on the server.\nUI:N - The attacking NFS client drives the entire sequence itself by issuing RENAME requests; no administrator or user action on the server is required.\nS:U - The leaked mnt_want_write()/sb_start_write() reference affects only the exported filesystem within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an unbalanced mount write-access/freeze-protection reference on an error path; no memory is read out of bounds, no kernel pointer or file content is exposed, and the rename itself never executes.\nI:N - Nothing is written or modified \u2014 the operation fails with NFS3ERR_XDEV/NFSERR_ACCES and returns; there is no memory corruption or arbitrary-write primitive of any kind.\nA:H - The error path returns while still holding the export\u0027s remount/freeze protection, and a remote client can drive it repeatedly across concurrent connections to keep write references pinned on the exported filesystem, indefinitely stalling fsfreeze and remount-read-only (snapshot/backup) operations on that mount."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:56.369Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"
        }
      ],
      "title": "nfsd: Fix error cleanup path in nfsd_rename()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35914",
    "datePublished": "2024-05-19T08:35:07.367Z",
    "dateReserved": "2024-05-17T13:50:33.122Z",
    "dateUpdated": "2026-08-05T11:30:56.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.929Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35914\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-18T16:53:51.345113Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T16:53:59.236Z\"}}], \"cna\": {\"title\": \"nfsd: Fix error cleanup path in nfsd_rename()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached purely by sending an NFSv2/v3 RENAME RPC or an NFSv4 COMPOUND containing RENAME over TCP/2049. No local access to the server is needed.\\nAC:L - The remote client supplies both directory filehandles itself and can retry the request an unbounded number of times; nfsd explicitly tolerates DCACHE_DISCONNECTED directory dentries (it only warns), so the lock_rename() -EXDEV bail-out is reachable from client-controlled input rather than depending on a condition the attacker cannot influence.\\nPR:N - With the standard AUTH_SYS/AUTH_UNIX export configuration nfsd performs no cryptographic authentication \\u2014 the client asserts its own uid/gid, so the fh_verify() NFSD_MAY_REMOVE/NFSD_MAY_CREATE checks are satisfied by a self-declared identity. Any host permitted by the export list can trigger it with no privileges on the server.\\nUI:N - The attacking NFS client drives the entire sequence itself by issuing RENAME requests; no administrator or user action on the server is required.\\nS:U - The leaked mnt_want_write()/sb_start_write() reference affects only the exported filesystem within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The defect is an unbalanced mount write-access/freeze-protection reference on an error path; no memory is read out of bounds, no kernel pointer or file content is exposed, and the rename itself never executes.\\nI:N - Nothing is written or modified \\u2014 the operation fails with NFS3ERR_XDEV/NFSERR_ACCES and returns; there is no memory corruption or arbitrary-write primitive of any kind.\\nA:H - The error path returns while still holding the export\u0027s remount/freeze protection, and a remote client can drive it repeatedly across concurrent connections to keep write references pinned on the exported filesystem, indefinitely stalling fsfreeze and remount-read-only (snapshot/backup) operations on that mount.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a8b0026847b8c43445c921ad2c85521c92eb175f\", \"lessThan\": \"331e125e02c08ffaecc1074af78a988a278039bd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a8b0026847b8c43445c921ad2c85521c92eb175f\", \"lessThan\": \"9fe6e9e7b58944037714442384075c17cfde1c56\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/vfs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/vfs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd\"}, {\"url\": \"https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: Fix error cleanup path in nfsd_rename()\\n\\nCommit a8b0026847b8 (\\\"rename(): avoid a deadlock in the case of parents\\nhaving no common ancestor\\\") added an error bail out path. However this\\npath does not drop the remount protection that has been acquired. Fix\\nthe cleanup path to properly drop the remount protection.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:56.369Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35914\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:56.369Z\", \"dateReserved\": \"2024-05-17T13:50:33.122Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:35:07.367Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.