CVE-2024-56779

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur

The action force umount(umount -f) will attempt to kill all rpc_task even

umount operation may ultimately fail if some files remain open.

Consequently, if an action attempts to open a file, it can potentially

send two rpc_task to nfs server.

NFS CLIENT

thread1 thread2

open("file")

...

nfs4_do_open

_nfs4_do_open

_nfs4_open_and_get_state

_nfs4_proc_open

nfs4_run_open_task

/* rpc_task1 */

rpc_run_task

rpc_wait_for_completion_task

umount -f

nfs_umount_begin

rpc_killall_tasks

rpc_signal_task

rpc_task1 been wakeup

and return -512

_nfs4_do_open // while loop

...

nfs4_run_open_task

/* rpc_task2 */

rpc_run_task

rp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References