In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-4.14.238-182.421Upgrade perfUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kernel-preempt-develUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade kernel-docsUpgrade kernel-symsUpgrade kernel-preemptUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-zfcpdump | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-5.4Upgrade linux-fipsUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-gcp-5.4Upgrade linuxUpgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-kvmUpgrade linux-gcp-4.15Upgrade linux-oracleUpgrade linux-gcp-fipsUpgrade linux-azure-5.4Upgrade linux-aws-fipsUpgrade linux-hweUpgrade linux-hwe-5.4Upgrade linux-gkeopUpgrade linux-raspi-5.4Upgrade linux-azure-4.15Upgrade linux-azure | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub