In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade perfUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.238-182.421Upgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-preemptUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-64kb-develUpgrade kernel-sourceUpgrade kernel-docsUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-preempt-develUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade kernel-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-oracle-5.4Upgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-gcp-5.4Upgrade linuxUpgrade linux-aws-hweUpgrade linux-gcpUpgrade linux-awsUpgrade linux-hweUpgrade linux-azure-5.4Upgrade linux-hwe-5.4Upgrade linux-aws-fipsUpgrade linux-gkeopUpgrade linux-azure-4.15Upgrade linux-azureUpgrade linux-azure-fipsUpgrade linux-oracleUpgrade linux-gcp-4.15Upgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-raspi-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub