CVE-2024-46690 (GCVE-0-2024-46690)

Vulnerability from cvelistv5 – Published: 2024-09-13 05:29 – Updated: 2026-08-05 11:37
VLAI
Title
nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to dereference fl->c.flc_owner without first confirming fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() tests fl_lmops but largely ignores the result and assumes that flc_owner is an nfs4_delegation anyway. This is wrong. With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave as it did before the change mentioned below. This is the same as the current code, but without any reference to a possible delegation.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c5967721e1063648b0506481585ba7e2e49a075e , < 1b46a871e980e3daa16fd5e77539966492e8910a (git)
Affected: c5967721e1063648b0506481585ba7e2e49a075e , < 40927f3d0972bf86357a32a5749be71a551241b6 (git)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.10.8 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:07:08.535058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:07:22.328Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b46a871e980e3daa16fd5e77539966492e8910a",
              "status": "affected",
              "version": "c5967721e1063648b0506481585ba7e2e49a075e",
              "versionType": "git"
            },
            {
              "lessThan": "40927f3d0972bf86357a32a5749be71a551241b6",
              "status": "affected",
              "version": "c5967721e1063648b0506481585ba7e2e49a075e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\n\nIt is not safe to dereference fl-\u003ec.flc_owner without first confirming\nfl-\u003efl_lmops is the expected manager.  nfsd4_deleg_getattr_conflict()\ntests fl_lmops but largely ignores the result and assumes that flc_owner\nis an nfs4_delegation anyway.  This is wrong.\n\nWith this patch we restore the \"!= \u0026nfsd_lease_mng_ops\" case to behave\nas it did before the change mentioned below.  This is the same as the\ncurrent code, but without any reference to a possible delegation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable function is in the in-kernel NFS server and is reached purely by an NFSv4 COMPOUND GETATTR requesting the change or size attribute over TCP port 2049. No local access to the server is required to drive the confused dereference.\nAC:L - The trigger (GETATTR for size/change on a chosen file) is issued at will and repeatably, and the required non-nfsd F_WRLCK lease is attacker-creatable in the standard multiprotocol NAS deployment the commit describes \u2014 the same tree exported via Samba, which takes fcntl(F_SETLEASE, F_WRLCK) kernel oplocks on behalf of an SMB client. The attacker therefore controls both the precondition and the trigger; no timing window or unknowable memory state must be guessed.\nPR:N - NFS AUTH_SYS verifies no credentials \u2014 any host permitted by the export list simply asserts a uid, and CVSS does not treat network-level export ACLs as a privilege. Issuing a GETATTR for size/change requires nothing beyond a mount of an ordinary export.\nUI:N - The attacker drives both the lease-establishing open and the GETATTR itself; no action by any legitimate user or administrator is needed.\nS:U - The type confusion corrupts kernel slab memory within the same security authority as the nfsd server; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `*size = ncf-\u003encf_cur_fsize` reads 8 bytes roughly 400 bytes past the end of the 232-byte struct file and encodes them into the FATTR4_SIZE field of the GETATTR reply, directly disclosing adjacent kernel heap contents to the remote client, on top of the OOB pointer reads of `cb_clp`/`cb_ops`.\nI:H - The path performs multiple out-of-bounds writes into the neighbouring slab object (`test_and_set_bit` on ncf_cb_flags, the u32 ncf_cb_status store, the u64 ncf_cur_fsize store, the ncf_file_modified byte) plus a refcount_inc over struct file\u0027s first word, and reaches an indirect call through `s-\u003esc_free` and `cb-\u003ecb_ops` read from confused/OOB memory \u2014 a groomable control-flow hijack primitive.\nA:H - `nfsd4_run_cb()` dereferences `clp` read from out-of-bounds memory and calls queue_work() on an uninitialized work_struct, and nfs4_put_stid() spin_locks a garbage pointer, so a single GETATTR reliably oopses or panics the NFS file server and can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:58.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a"
        },
        {
          "url": "https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6"
        }
      ],
      "title": "nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46690",
    "datePublished": "2024-09-13T05:29:20.368Z",
    "dateReserved": "2024-09-11T15:12:18.249Z",
    "dateUpdated": "2026-08-05T11:37:58.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46690",
      "date": "2026-08-06",
      "epss": "0.00401",
      "percentile": "0.32856"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.10.8\", \"matchCriteriaId\": \"0BCC4AEF-4876-4CFA-B9D6-F98855E75E74\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\\n\\nIt is not safe to dereference fl-\u003ec.flc_owner without first confirming\\nfl-\u003efl_lmops is the expected manager.  nfsd4_deleg_getattr_conflict()\\ntests fl_lmops but largely ignores the result and assumes that flc_owner\\nis an nfs4_delegation anyway.  This is wrong.\\n\\nWith this patch we restore the \\\"!= \u0026nfsd_lease_mng_ops\\\" case to behave\\nas it did before the change mentioned below.  This is the same as the\\ncurrent code, but without any reference to a possible delegation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: corregir nfsd4_deleg_getattr_conflict en presencia de una concesi\\u00f3n de terceros No es seguro desreferenciar fl-\u0026gt;c.flc_owner sin confirmar primero que fl-\u0026gt;fl_lmops es el administrador esperado. nfsd4_deleg_getattr_conflict() prueba fl_lmops pero ignora en gran medida el resultado y asume que flc_owner es una nfs4_delegation de todos modos. Esto es incorrecto. Con este parche restauramos el caso \\\"!= \u0026amp;nfsd_lease_mng_ops\\\" para que se comporte como lo hac\\u00eda antes del cambio mencionado a continuaci\\u00f3n. Esto es lo mismo que el c\\u00f3digo actual, pero sin ninguna referencia a una posible delegaci\\u00f3n.\"}]",
      "id": "CVE-2024-46690",
      "lastModified": "2024-09-20T15:55:24.430",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-13T06:15:13.753",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46690\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-13T06:15:13.753\",\"lastModified\":\"2026-08-04T11:20:15.520\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\\n\\nIt is not safe to dereference fl-\u003ec.flc_owner without first confirming\\nfl-\u003efl_lmops is the expected manager.  nfsd4_deleg_getattr_conflict()\\ntests fl_lmops but largely ignores the result and assumes that flc_owner\\nis an nfs4_delegation anyway.  This is wrong.\\n\\nWith this patch we restore the \\\"!= \u0026nfsd_lease_mng_ops\\\" case to behave\\nas it did before the change mentioned below.  This is the same as the\\ncurrent code, but without any reference to a possible delegation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: corregir nfsd4_deleg_getattr_conflict en presencia de una concesi\u00f3n de terceros No es seguro desreferenciar fl-\u0026gt;c.flc_owner sin confirmar primero que fl-\u0026gt;fl_lmops es el administrador esperado. nfsd4_deleg_getattr_conflict() prueba fl_lmops pero ignora en gran medida el resultado y asume que flc_owner es una nfs4_delegation de todos modos. Esto es incorrecto. Con este parche restauramos el caso \\\"!= \u0026amp;nfsd_lease_mng_ops\\\" para que se comporte como lo hac\u00eda antes del cambio mencionado a continuaci\u00f3n. Esto es lo mismo que el c\u00f3digo actual, pero sin ninguna referencia a una posible delegaci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c5967721e1063648b0506481585ba7e2e49a075e\",\"lessThan\":\"1b46a871e980e3daa16fd5e77539966492e8910a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c5967721e1063648b0506481585ba7e2e49a075e\",\"lessThan\":\"40927f3d0972bf86357a32a5749be71a551241b6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.8\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T15:07:08.535058Z\",\"id\":\"CVE-2024-46690\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.10.8\",\"matchCriteriaId\":\"0BCC4AEF-4876-4CFA-B9D6-F98855E75E74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:03:14+00:00",
      "cve": "CVE-2024-46690",
      "id": "CVE-2024-46690",
      "initial_release_date": "2024-09-13T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46690.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T16:53:43Z",
      "cve": "CVE-2024-46690",
      "id": "CVE-2024-46690",
      "initial_release_date": "2024-09-14T02:51:18Z",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46690",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46690.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46690\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:07:08.535058Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:07:12.669Z\"}}], \"cna\": {\"title\": \"nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c5967721e106\", \"lessThan\": \"1b46a871e980\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c5967721e106\", \"lessThan\": \"40927f3d0972\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/nfs4state.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"6.10.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/nfs4state.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a\"}, {\"url\": \"https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\\n\\nIt is not safe to dereference fl-\u003ec.flc_owner without first confirming\\nfl-\u003efl_lmops is the expected manager.  nfsd4_deleg_getattr_conflict()\\ntests fl_lmops but largely ignores the result and assumes that flc_owner\\nis an nfs4_delegation anyway.  This is wrong.\\n\\nWith this patch we restore the \\\"!= \u0026nfsd_lease_mng_ops\\\" case to behave\\nas it did before the change mentioned below.  This is the same as the\\ncurrent code, but without any reference to a possible delegation.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-09-15T17:57:43.640Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46690\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-29T15:07:22.328Z\", \"dateReserved\": \"2024-09-11T15:12:18.249Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T05:29:20.368Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.