CVE-2024-56558: nfsd: make sure exp active before svc_export_show
In the Linux kernel, the following vulnerability has been resolved:
nfsd: make sure exp active before svcexportshow
The function eshow was called with protection from RCU. This only ensures that exp will not be freed. Therefore, the reference count for exp can drop to zero, which will trigger a refcount use-after-free warning when expget is called. To resolve this issue, use cachegetrcu to ensure that exp remains active.
------------[ cut here ]------------ refcountt: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcountwarnsaturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcountwarnsaturate+0xb1/0x120 ... Call Trace: <TASK> eshow+0x20b/0x230 [nfsd] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
Other sources
In the Linux kernel, the following vulnerability has been resolved:
nfsd: make sure exp active before svcexportshow
The function eshow was called with protection from RCU. This only ensures that exp will not be freed. Therefore, the reference count for exp can drop to zero, which will trigger a refcount use-after-free warning when expget is called. To resolve this issue, use cachegetrcu to ensure that exp remains active.
------------[ cut here ]------------ refcountt: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcountwarnsaturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcountwarnsaturate+0xb1/0x120 ... Call Trace: <TASK> eshow+0x20b/0x230 [nfsd] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
Apply the Linux kernel fix described as: "nfsd: make sure exp active before svc_export_show" by ensuring `exp` remains active using `cache_get_rcu` before calling `svc_export_show` (in the `e_show` path for `nfsd`).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56558?
CVE-2024-56558 is considered to have a high severity due to potential exploitation leading to denial of service.
How do I fix CVE-2024-56558?
To fix CVE-2024-56558, upgrade to the latest version of the Linux Kernel that addresses this vulnerability.
What systems are affected by CVE-2024-56558?
CVE-2024-56558 affects multiple versions of the Linux Kernel, specifically those from 3.17 through 6.12.4.
Can CVE-2024-56558 lead to data loss?
Potentially, CVE-2024-56558 could lead to data loss if exploited, as it may allow denial of service conditions.
What is the cause of CVE-2024-56558?
CVE-2024-56558 is caused by an insufficient reference count management within the `e_show` function in the Linux Kernel.