CVE-2024-36958 (GCVE-0-2024-36958)
Vulnerability from cvelistv5
Published
2024-05-30 15:35
Modified
2026-08-05 11:32
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
References
Impacted products
Vendor Product Version
Linux Linux Version: 83ab8678ad0c6f27594c716cafe59c8bbd5e49ef
Version: 83ab8678ad0c6f27594c716cafe59c8bbd5e49ef
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36958",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T17:56:01.903587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T18:14:12.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-04T23:03:04.876Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250404-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a7b07689af6e4e023404bf69b1230f43b2a15bc",
              "status": "affected",
              "version": "83ab8678ad0c6f27594c716cafe59c8bbd5e49ef",
              "versionType": "git"
            },
            {
              "lessThan": "18180a4550d08be4eb0387fe83f02f703f92d4e7",
              "status": "affected",
              "version": "83ab8678ad0c6f27594c716cafe59c8bbd5e49ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix nfsd4_encode_fattr4() crasher\n\nEnsure that args.acl is initialized early. It is used in an\nunconditional call to kfree() on the way out of\nnfsd4_encode_fattr4()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The defect is in the in-kernel NFSv4 server\u0027s attribute encoder, driven directly by client-supplied GETATTR/READDIR/VERIFY operations inside a COMPOUND arriving on TCP port 2049. A remote peer acting as an NFS client drives the entire path with no local access.\nAC:L - The attacker supplies the attribute bitmap that selects the early-exit path and can independently create the triggering condition (referral export lookup, or holding a write delegation and stalling CB_GETATTR so nfsd4_deleg_getattr_conflict returns nfserr_jukebox), and can repeat it at will \u2014 including once per entry in a READDIR loop for stack grooming.\nPR:N - PUTROOTFH requires no clientid or prior state establishment and GETATTR is flagged ALLOWED_ON_ABSENT_FS, so a single compound reaches the code; under the ubiquitous sec=sys (AUTH_SYS) flavor there is no cryptographic authentication at all, the client merely asserts a uid.\nUI:N - The attacker issues the NFSv4 COMPOUND requests and holds any conflicting delegation entirely on its own. No administrator or other user on the server needs to act.\nS:U - The bad free corrupts the kernel\u0027s own slab allocator within the same security authority as the nfsd kthread. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - kfree() on an uninitialized stack pointer is an arbitrary-free primitive: freeing a live slab object yields a use-after-free with a stale reference to kernel objects, the standard route to disclosing arbitrary kernel memory. The stack slot lies ~280 bytes deep in the frame and is influenced by preceding XDR-decode and VFS frames on the reused nfsd thread stack, making the freed target selectable.\nI:H - An arbitrary free is a full memory-corruption primitive \u2014 the reclaimed slab object can be sprayed with attacker-chosen data from concurrent NFS requests, producing a write primitive and control-flow hijack in kernel context. This is at least as strong as a plain use-after-free, which is scored High.\nA:H - kfree() on arbitrary stack residue \u2014 a stack address, a non-slab pointer, or an already-freed object \u2014 triggers slab corruption, an allocator BUG, or an oops in the nfsd kthread, panicking the server. The trigger is repeatable on demand, so the NFS server can be taken down reliably."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:13.620Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7"
        }
      ],
      "title": "NFSD: Fix nfsd4_encode_fattr4() crasher",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36958",
    "datePublished": "2024-05-30T15:35:51.033Z",
    "dateReserved": "2024-05-30T15:25:07.080Z",
    "dateUpdated": "2026-08-05T11:32:13.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250404-0007/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-04-04T23:03:04.876Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36958\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-05T17:56:01.903587Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-05T18:14:09.278Z\"}}], \"cna\": {\"title\": \"NFSD: Fix nfsd4_encode_fattr4() crasher\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"83ab8678ad0c6f27594c716cafe59c8bbd5e49ef\", \"lessThan\": \"6a7b07689af6e4e023404bf69b1230f43b2a15bc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"83ab8678ad0c6f27594c716cafe59c8bbd5e49ef\", \"lessThan\": \"18180a4550d08be4eb0387fe83f02f703f92d4e7\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/nfs4xdr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/nfs4xdr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc\"}, {\"url\": \"https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSD: Fix nfsd4_encode_fattr4() crasher\\n\\nEnsure that args.acl is initialized early. It is used in an\\nunconditional call to kfree() on the way out of\\nnfsd4_encode_fattr4().\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:03:18.767Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36958\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-04T23:03:04.876Z\", \"dateReserved\": \"2024-05-30T15:25:07.080Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:35:51.033Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.