CVE-2024-58092: nfsd: fix legacy client tracking initialization
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix legacy client tracking initialization
Get rid of the nfsd4legacytrackingops->init() call in checkforlegacymethods(). That will be handled in the caller (nfsd4clienttrackinginit()). Otherwise, we'll wind up calling nfsd4legacytrackingops->init() twice, and the second time we'll trigger the BUGON() in nfsd4initrecdir().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.22-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.22 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.13.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58092?
CVE-2024-58092 is classified with a medium severity level due to its impact on kernel functionalities.
How do I fix CVE-2024-58092?
To fix CVE-2024-58092, ensure that you update to the latest patched version of the Linux kernel recommended by your distribution.
What software is affected by CVE-2024-58092?
CVE-2024-58092 affects the Linux kernel, particularly versions that utilize the nfsd functionality.
What are the potential consequences of CVE-2024-58092?
The potential consequences of CVE-2024-58092 include issues with legacy client tracking that could lead to compromised client communications.
Is there a workaround for CVE-2024-58092 while waiting for a patch?
Currently, there are no known workarounds for CVE-2024-58092, making timely patching essential.