PT-2024-21546 · Linux+9 · Linux Kernel+9
Jorge Mora
·
Published
2024-01-25
·
Updated
2025-09-29
·
CVE-2024-26870
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.0-61.fc40.aarch64
Description
A vulnerability has been resolved in the Linux kernel, specifically in the NFSv4.2 module. The issue arises when the
listxattr() function is called with a buffer size of 0, which returns the actual size of the buffer needed for a subsequent call. However, when the size is greater than 0, nfs4 listxattr() does not return an error, causing the nfs4 listxattr nfs4 user() function to trigger a kernel bug. This bug is reproduced when generic listxattr() returns 'system.nfs4 acl', and lisxattr() is called with a size of 16. To fix this issue, a check has been added to nfs4 listxattr() to return an ERANGE error when it is called with a size greater than 0 and the return value is greater than the size.Recommendations
To resolve this issue, update the Linux kernel to a version later than 6.6.0-61.fc40.aarch64. As a temporary workaround, consider disabling the
nfs4 listxattr() function until a patch is available. Additionally, restrict access to the vulnerable NFSv4.2 module to minimize the risk of exploitation.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu