CVE-2024-36958: NFSD: Fix nfsd4_encode_fattr4() crasher
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix nfsd4encodefattr4() crasher
Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4encodefattr4().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
Ensure that args.acl is initialized early in nfsd4_encode_fattr4() to prevent the crasher caused by an unconditional kfree() call on the way out.
Linux kernel (NFSD) args.acl initialization = Initialize args.acl early before it is used in nfsd4_encode_fattr4()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36958?
CVE-2024-36958 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-36958?
To address CVE-2024-36958, upgrade to the fixed versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, or 6.12.12-1.
Which systems are affected by CVE-2024-36958?
CVE-2024-36958 affects various versions of the Linux kernel found in Debian-based systems.
What component of the Linux kernel is impacted by CVE-2024-36958?
CVE-2024-36958 impacts the NFSD component, specifically the nfsd4_encode_fattr4() function.
What potential issue does CVE-2024-36958 cause?
CVE-2024-36958 can lead to a crash due to an uninitialized variable in the nfsd4_encode_fattr4() function.