PT-2024-37051 · Linux · Linux Kernel
Mike Snitzer
·
Published
2024-11-09
·
Updated
2025-01-07
·
CVE-2024-56740
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to memory corruption that can occur due to NFSv3 LOCALIO reads leaving garbage in
res.replen. This happens when nfs3 read done() copies the value into server->read hdrsize, which is then copied to args.replen in new requests by nfs3 proc read setup(). The value is passed to rpc prepare reply pages(), included in hdrsize for xdr init pages, resulting in rq rcv buf containing a ridiculous length. This is eventually copied to rq private buf and passed to sock recvmsg(), which receives incoming data into the wrong place. The issue can be easily reproduced with NFSv3 LOCALIO servicing reads when it is made to pivot back to using normal RPC, such as when the NFSv3 server is stopped and then restarted while LOCALIO is performing heavy read IO.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel