CVE-2024-56779

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6+

Description A memory leak vulnerability has been resolved in the Linux kernel. The issue occurs when concurrent nfsd4 open requests are made, causing the nfsd to lose track of nfs4 openowner, leading to a memory leak. This situation can happen when two rpc task attempt to open the same file simultaneously from the client to the server, and two instances of nfsd run concurrently. Additionally, when echoing 0 to /proc/fs/nfsd/threads, a warning will be triggered.

Recommendations For Linux kernel versions prior to 6.12.0-rc6+, update to a newer version that contains the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable nfsd module to minimize the risk of exploitation. Avoid using the nfsd4 open function in the affected API endpoint until the issue is resolved. Restrict the use of the umount -f command to prevent the memory leak.