PT-2024-32124 · Linux+6 · Linux Kernel+6

Published 2024-08-22 · Updated 2025-09-29 · CVE-2024-46697

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises when nfsd4 encode fattr4 performs a "goto out" before checking for the security label, resulting in args.context being set to uninitialized data on the stack, which is then attempted to be freed. To resolve this, nfsd4 fattr args.context is initialized early.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-457

CWE-665

Related Identifiers

ALSA-2024:11486

ALSA-2024_11486

ALSA-2025_16880

ALT-PU-2024-13260

BDU:2025-03762

CVE-2024-46697

INFSA-2024_11486

RHSA-2024:11486

RHSA-2024_11486

USN-7154-1

USN-7154-2

USN-7155-1

USN-7156-1

USN-7196-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Linuxmint

Linux Kernel

Red Hat

Ubuntu

References · 678

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46697.json · Exploit
• https://ubuntu.com/security/CVE-2024-41079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46753 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53057 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42295 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45026 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42127 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46825 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43895 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42238 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42278 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43884 · Vendor Advisory