CVE-2024-47692

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: return -EINVAL when namelen is 0

When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may

result in namelen being 0, which will cause memdup_user() to return

ZERO_SIZE_PTR.

When we access the name.data that has been assigned the value of

ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is

triggered.

[ T1205] ==================================================================

[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260

[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205

[ T1205]

[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406

[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014

[ T1205] Call Trace:

[ T1205] dump_stack+0x9a/0xd0

[ T1205] ? nfs4_client_to_reclaim+0xe9/0x260

[ T1205] __kasan_report.cold+0x3

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References