In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade perfUpgrade kernel-livepatch-4.14.238-182.421Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade python-perfUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernelUpgrade bpftool-debuginfo | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-preempt-develUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-preempt | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-azure-5.4Upgrade linux-gkeopUpgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-azureUpgrade linux-azure-4.15Upgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-gcp-4.15Upgrade linux-raspi-5.4Upgrade linux-oracleUpgrade linux-kvmUpgrade linux-hweUpgrade linux-gcp-fipsUpgrade linux-aws-hweUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub