CVE-2024-36939

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfs: Handle error of rpc_proc_register() in nfs_net_init().

syzkaller reported a warning [0] triggered while destroying immature

netns.

rpc_proc_register() was called in init_nfs_fs(), but its error

has been ignored since at least the initial commit 1da177e4c3f4

("Linux-2.6.12-rc2").

Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs

in net namespaces") converted the procfs to per-netns and made

the problem more visible.

Even when rpc_proc_register() fails, nfs_net_init() could succeed,

and thus nfs_net_exit() will be called while destroying the netns.

Then, remove_proc_entry() will be called for non-existing proc

directory and trigger the warning below.

Let's handle the error of rpc_proc_register() properly in nfs_net_init().

[0]:

name 'nfs'

WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711

Modules linked in:

CPU: 1 PID: 1710 Comm: syz-executor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References