CVE-2024-50121

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net

In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the

function `nfs4_state_destroy_net` in `nfs4_state_shutdown_net` will

release all resources related to the hashed `nfs4_client`. If the

`nfsd_client_shrinker` is running concurrently, the `expire_client`

function will first unhash this client and then destroy it. This can

lead to the following warning. Additionally, numerous use-after-free

errors may occur as well.

nfsd_client_shrinker echo 0 > /proc/fs/nfsd/threads

expire_client nfsd_shutdown_net

unhash_client ...

nfs4_state_shutdown_net

/* won't wait shrinker exit */

/* cancel_work(&nn->nfsd_shrinker_work)

* nfsd_file for this /* won't destroy unhashed client1 */

* client1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References