In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-livepatch-4.14.238-182.421Upgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade perf-debuginfo | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-preempt-develUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-64kb-develUpgrade kernel-docsUpgrade kernel-preemptUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade kernel-source | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-gcp-5.4Upgrade linuxUpgrade linux-aws-hweUpgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-gkeopUpgrade linux-gcp-4.15Upgrade linux-hweUpgrade linux-raspi-5.4Upgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-azure-fipsUpgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-oracle | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub