CVE-2024-46690: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix nfsd4deleggetattrconflict in presence of third party lease
It is not safe to dereference fl->c.flcowner without first confirming fl->fllmops is the expected manager. nfsd4deleggetattrconflict() tests fllmops but largely ignores the result and assumes that flcowner is an nfs4delegation anyway. This is wrong.
With this patch we restore the "!= &nfsdleasemngops" case to behave as it did before the change mentioned below. This is the same as the current code, but without any reference to a possible delegation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46690?
CVE-2024-46690 has been classified with a high severity rating due to potential denial of service vulnerabilities in the Linux kernel.
How do I fix CVE-2024-46690?
To mitigate CVE-2024-46690, users should upgrade to the latest version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-46690?
CVE-2024-46690 affects Linux kernel versions from 6.9 up to 6.10.8, and also specific release candidates of version 6.11.
What impact does CVE-2024-46690 have on system security?
CVE-2024-46690 may allow unauthorized access to system resources, leading to potential data corruption or loss.
Is there a workaround for CVE-2024-46690?
There are currently no known workarounds for CVE-2024-46690, and upgrading is recommended for effective mitigation.