by Kastro
Paper/Archive/CVE-2024-36958

CVE-2024-36958

Linux Linux — NFSD: Fix nfsd4_encode_fattr4() crasher

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.5.425 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().

Affected

ProductAffectedFixed inSource
Linux83ab8678ad0c6f27594c716cafe59c8bbd5e49ef – < 6a7b07689af6e4e023404bf69b1230f43b2a15bc6a7b07689af6e4e023404bf69b1230f43b2a15bcCNA
Linux83ab8678ad0c6f27594c716cafe59c8bbd5e49ef – < 18180a4550d08be4eb0387fe83f02f703f92d4e718180a4550d08be4eb0387fe83f02f703f92d4e7CNA
Linux6.76.8.10CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bcrefgit.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7refsecurity.netapp.com/advisory/ntap-20250404-0007