{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53217", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.024Z", "datePublished": "2024-12-27T13:50:02.727Z", "dateUpdated": "2026-08-05T11:44:42.345Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:42.345Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent NULL dereference in nfsd4_process_cb_update()\n\n@ses is initialized to NULL. If __nfsd4_find_backchannel() finds no\navailable backchannel session, setup_callback_client() will try to\ndereference @ses and segfault." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable path is in the in-kernel NFS server and is driven entirely by NFSv4.1 protocol operations (CREATE_SESSION, BIND_CONN_TO_SESSION, BACKCHANNEL_CTL, DESTROY_SESSION, or simply dropping the backchannel TCP connection) arriving on port 2049. No local access to the server is needed.\nAC:L - The attacker fully controls the precondition — a session with no backchannel connection is produced deterministically by creating a session without SESSION4_BACK_CHAN or by closing the connection that carried it, then poking the callback update path. No unpredictable memory layout or victim state is involved, and the sequence can be repeated at will.\nPR:N - EXCHANGE_ID/CREATE_SESSION/BIND_CONN_TO_SESSION are handled before any credential is actually verified, and the default SP4_NONE state protection makes nfsd4_mach_creds_match() a no-op; under AUTH_SYS/AUTH_NULL a client merely asserts an identity. Any host that can reach the exported NFS service can trigger it.\nUI:N - The whole sequence is issued by the attacking NFS client; no administrator or local user on the server has to mount anything, open a file, or take any action.\nS:U - The fault occurs in the nfsd callback workqueue inside the kernel's own security authority, and the damage is confined to that kernel instance. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is a read of a NULL struct nfsd4_session pointer at a small fixed offset; it faults immediately rather than returning data, and no attacker-controlled memory is read back or exposed to the client.\nI:N - There is no write through the NULL pointer and no attacker-influenced offset — the assignments that follow never execute because the load faults first, so no kernel memory or file data can be modified.\nA:H - The dereference oopses in a workqueue kernel thread, killing the nfsd callback machinery and leaving locks/references stranded, which takes down NFS service and can panic the host on panic_on_oops systems. It is remotely and repeatably triggerable without authentication." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfsd/nfs4callback.c" ], "versions": [ { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "d9a0d1f6e15859ea7a86a327f28491e23deaaa62", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "cac1405e3ff6685a438e910ad719e0cf06af90ee", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "752a75811f27300fe8131b0a1efc91960f6f88e7", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "c5d90f9302742985a5078e42ac38de42c364c44a", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "0c3b0e326f838787d229314d4de83af9c53347e8", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "eb51733ae5fc73d95bd857d5da26f9f65b202a79", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "03178cd8f67227015debb700123987fe96275cd1", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "4a4ffc1aa9d618e41ad9151f40966e402e58a5a2", "status": "affected", "versionType": "git" }, { "version": "dcbeaa68dbbdacbbb330a86c7fc95a28473fc209", "lessThan": "1e02c641c3a43c88cecc08402000418e15578d38", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfsd/nfs4callback.c" ], "versions": [ { "version": "2.6.38", "status": "affected" }, { "version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.325", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "4.19.325" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.4.287" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.10.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d9a0d1f6e15859ea7a86a327f28491e23deaaa62" }, { "url": "https://git.kernel.org/stable/c/cac1405e3ff6685a438e910ad719e0cf06af90ee" }, { "url": "https://git.kernel.org/stable/c/752a75811f27300fe8131b0a1efc91960f6f88e7" }, { "url": "https://git.kernel.org/stable/c/c5d90f9302742985a5078e42ac38de42c364c44a" }, { "url": "https://git.kernel.org/stable/c/0c3b0e326f838787d229314d4de83af9c53347e8" }, { "url": "https://git.kernel.org/stable/c/eb51733ae5fc73d95bd857d5da26f9f65b202a79" }, { "url": "https://git.kernel.org/stable/c/03178cd8f67227015debb700123987fe96275cd1" }, { "url": "https://git.kernel.org/stable/c/4a4ffc1aa9d618e41ad9151f40966e402e58a5a2" }, { "url": "https://git.kernel.org/stable/c/1e02c641c3a43c88cecc08402000418e15578d38" } ], "title": "NFSD: Prevent NULL dereference in nfsd4_process_cb_update()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53217", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:03:26.697178Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:19.173Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:47:47.124Z" } } ] } }