CVE-2024-46690

MEDIUM EPSS 8.3%
Published Sep 13, 20241y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Sep 13, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to dereference fl->c.flc_owner without first confirming fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() tests fl_lmops but largely ignores the result and assumes that flc_owner is an nfs4_delegation anyway. This is wrong. With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave as it did before the change mentioned below. This is the same as the current code, but without any reference to a possible delegation.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
8.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥6.9  –  <6.10.8
linuxlinux_kernel6.11any
linuxlinux_kernel6.11any
linuxlinux_kernel6.11any
linuxlinux_kernel6.11any
linuxlinux_kernel6.11any

References 2

  • git.kernel.org https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6
    Patch