PT-2024-27223

CVE-2024-36958

Published

2024-04-25

Updated

2025-04-04

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the NFSD component in the Linux kernel, specifically with the nfsd4 encode fattr4() function. The problem arises because args.acl is not initialized early and is used in an unconditional call to kfree() when exiting nfsd4 encode fattr4(). This can lead to a crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Scott Mayhew

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2024-36958