In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.238-182.421Upgrade kernel-develUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfo | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-tools | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-macrosUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-preemptUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-develUpgrade kernel-preempt-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-default | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-fipsUpgrade linux-aws-hweUpgrade linuxUpgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-azure-5.4Upgrade linux-hwe-5.4Upgrade linux-azure-fipsUpgrade linux-oracleUpgrade linux-raspi-5.4Upgrade linux-gcp-4.15Upgrade linux-gkeopUpgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-azure | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub