We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-47692

nfsd: return -EINVAL when namelen is 0



Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: return -EINVAL when namelen is 0 When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdup_user() to return ZERO_SIZE_PTR. When we access the name.data that has been assigned the value of ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is triggered. [ T1205] ================================================================== [ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260 [ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205 [ T1205] [ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406 [ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ T1205] Call Trace: [ T1205] dump_stack+0x9a/0xd0 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] __kasan_report.cold+0x34/0x84 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] kasan_report+0x3a/0x50 [ T1205] nfs4_client_to_reclaim+0xe9/0x260 [ T1205] ? nfsd4_release_lockowner+0x410/0x410 [ T1205] cld_pipe_downcall+0x5ca/0x760 [ T1205] ? nfsd4_cld_tracking_exit+0x1d0/0x1d0 [ T1205] ? down_write_killable_nested+0x170/0x170 [ T1205] ? avc_policy_seqno+0x28/0x40 [ T1205] ? selinux_file_permission+0x1b4/0x1e0 [ T1205] rpc_pipe_write+0x84/0xb0 [ T1205] vfs_write+0x143/0x520 [ T1205] ksys_write+0xc9/0x170 [ T1205] ? __ia32_sys_read+0x50/0x50 [ T1205] ? ktime_get_coarse_real_ts64+0xfe/0x110 [ T1205] ? ktime_get_coarse_real_ts64+0xa2/0x110 [ T1205] do_syscall_64+0x33/0x40 [ T1205] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ T1205] RIP: 0033:0x7fdbdb761bc7 [ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514 [ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7 [ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008 [ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001 [ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b [ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000 [ T1205] ================================================================== Fix it by checking namelen.

Reserved 2024-09-30 | Published 2024-10-21 | Updated 2025-05-04 | Assigner Linux

Product status

Default status
unaffected

74725959c33c14114fdce1e36e3504d106584d53 before 6d07040ae5c2214e39c7444d898039c9e655a79a
affected

74725959c33c14114fdce1e36e3504d106584d53 before 0f1d007bbea38a61cf9c5392708dc70ae9d84a3d
affected

74725959c33c14114fdce1e36e3504d106584d53 before b7b7a8df41ef18862dd6b22289fb46c2c12398af
affected

74725959c33c14114fdce1e36e3504d106584d53 before 84a563d136faf514fdad1ade28d7a142fd313cb8
affected

74725959c33c14114fdce1e36e3504d106584d53 before 318f70857caab3da9a6ada9bc8c1f4f7591b695e
affected

74725959c33c14114fdce1e36e3504d106584d53 before 766d5fbd78f7a52b3888449a0358760477b74602
affected

74725959c33c14114fdce1e36e3504d106584d53 before 1ff8be8d008b9ddc8e7043fbddd37d5d451b271b
affected

74725959c33c14114fdce1e36e3504d106584d53 before 22451a16b7ab7debefce660672566be887db1637
affected

Default status
affected

5.2
affected

Any version before 5.2
unaffected

5.4.285
unaffected

5.10.227
unaffected

5.15.168
unaffected

6.1.113
unaffected

6.6.54
unaffected

6.10.13
unaffected

6.11.2
unaffected

6.12
unaffected

References

git.kernel.org/...c/6d07040ae5c2214e39c7444d898039c9e655a79a

git.kernel.org/...c/0f1d007bbea38a61cf9c5392708dc70ae9d84a3d

git.kernel.org/...c/b7b7a8df41ef18862dd6b22289fb46c2c12398af

git.kernel.org/...c/84a563d136faf514fdad1ade28d7a142fd313cb8

git.kernel.org/...c/318f70857caab3da9a6ada9bc8c1f4f7591b695e

git.kernel.org/...c/766d5fbd78f7a52b3888449a0358760477b74602

git.kernel.org/...c/1ff8be8d008b9ddc8e7043fbddd37d5d451b271b

git.kernel.org/...c/22451a16b7ab7debefce660672566be887db1637

cve.org (CVE-2024-47692)

nvd.nist.gov (CVE-2024-47692)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-47692

Support options

Helpdesk Chat, Email, Knowledgebase