{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56740", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T11:26:39.757Z", "datePublished": "2024-12-29T11:30:09.180Z", "dateUpdated": "2026-08-05T11:46:20.277Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:20.277Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs/localio: must clear res.replen in nfs_local_read_done\n\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\nleaving garbage in res.replen:\n- nfs3_read_done() copies that into server->read_hdrsize; from there\n nfs3_proc_read_setup() copies it to args.replen in new requests.\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\n which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\n contains a ridiculous len.\n- This is copied to rq_private_buf and xs_read_stream_request()\n eventually passes the kvec to sock_recvmsg() which receives incoming\n data into entirely the wrong place.\n\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\nwhen it is made to pivot back to using normal RPC. This switch back\nto using normal NFSv3 with RPC can occur for a few reasons but this\nissue was exposed with a test that stops and then restarts the NFSv3\nserver while LOCALIO is performing heavy read IO." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - LOCALIO is only negotiated when the NFS client and nfsd run on the same host, so the RPC transport whose receive path is misdirected is host-local; exploitation requires a local process to read files over that mount and to induce the LOCALIO-to-RPC pivot. A remote NFS client can supply the file bytes that end up splattered over the slab, but cannot itself reach or trigger the corrupting path.\nAC:L - The poisoning is deterministic — the very first successful LOCALIO read latches a heap-pointer value into server->read_hdrsize via cmpxchg, and every subsequent RPC read then misdirects sock_recvmsg; the upstream commit states it is \"easily reproduced\". The pivot back to RPC is reachable through attacker-inducible conditions such as memory pressure causing nfs_local_open_fh() to fail with -ENOMEM.\nPR:L - An unprivileged local user with access to the existing LOCALIO-enabled NFS mount can perform the reads that both poison read_hdrsize and later trigger the out-of-bounds receive, and can drive the memory pressure that forces the fallback to RPC. No capabilities are needed once the mount is present.\nUI:N - Exploitation only requires ordinary read I/O on an already-mounted NFS filesystem; no administrator or victim action beyond routine file access is needed.\nS:U - The corruption is confined to kernel slab memory within the same security authority as the vulnerable component; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The corrupted xdr_buf leaves tail->iov_base pointing far outside the RPC buffer with an underflowed tail->iov_len, so subsequent XDR decode reads out-of-bounds kernel memory and can surface it to userspace as read data; a slab overflow of this size is readily leveraged into an arbitrary-read primitive.\nI:H - sock_recvmsg() writes up to rsize bytes (hundreds of KB) of server-supplied file data linearly past a small rpc_buffer slab object, and the corrupted tail kvec adds a wild-pointer write — a controllable heap overflow suitable for control-flow hijacking.\nA:H - Overrunning the rpc_buffer slab by hundreds of kilobytes destroys adjacent kernel objects and reliably produces oops/panic or slab corruption, halting the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfs/localio.c" ], "versions": [ { "version": "70ba381e1a431245c137ed597ec6a05991c79bd9", "lessThan": "de5dac261eeab99762bbdf7c20cee5d26ef4462e", "status": "affected", "versionType": "git" }, { "version": "70ba381e1a431245c137ed597ec6a05991c79bd9", "lessThan": "650703bc4ed3edf841e851c99ab8e7ba9e5262a3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfs/localio.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e" }, { "url": "https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3" } ], "title": "nfs/localio: must clear res.replen in nfs_local_read_done", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-56740", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:57:38.126609Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:04.078Z" } } ] } }