by Kastro
Paper/Archive/CVE-2024-46696

CVE-2024-46696

Linux Linux — nfsd: fix potential UAF in nfsd4_cb_getattr_release

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.5.375 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix potential UAF in nfsd4_cb_getattr_release Once we drop the delegation reference, the fields embedded in it are no longer safe to access. Do that last.

Affected

ProductAffectedFixed inSource
Linuxc5967721e1063648b0506481585ba7e2e49a075e – < e0b66698a5ae41078f7490e8b3527013f5fccd6ce0b66698a5ae41078f7490e8b3527013f5fccd6cCNA
Linuxc5967721e1063648b0506481585ba7e2e49a075e – < 1116e0e372eb16dd907ec571ce5d4af325c55c101116e0e372eb16dd907ec571ce5d4af325c55c10CNA
Linux6.96.10.8CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgit.kernel.org/stable/c/e0b66698a5ae41078f7490e8b3527013f5fccd6crefgit.kernel.org/stable/c/1116e0e372eb16dd907ec571ce5d4af325c55c10