{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56779", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T11:26:39.767Z", "datePublished": "2025-01-08T17:49:17.070Z", "dateUpdated": "2026-08-05T11:46:27.780Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:27.780Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur\n\nThe action force umount(umount -f) will attempt to kill all rpc_task even\numount operation may ultimately fail if some files remain open.\nConsequently, if an action attempts to open a file, it can potentially\nsend two rpc_task to nfs server.\n\n NFS CLIENT\nthread1 thread2\nopen(\"file\")\n...\nnfs4_do_open\n _nfs4_do_open\n _nfs4_open_and_get_state\n _nfs4_proc_open\n nfs4_run_open_task\n /* rpc_task1 */\n rpc_run_task\n rpc_wait_for_completion_task\n\n umount -f\n nfs_umount_begin\n rpc_killall_tasks\n rpc_signal_task\n rpc_task1 been wakeup\n and return -512\n _nfs4_do_open // while loop\n ...\n nfs4_run_open_task\n /* rpc_task2 */\n rpc_run_task\n rpc_wait_for_completion_task\n\nWhile processing an open request, nfsd will first attempt to find or\nallocate an nfs4_openowner. If it finds an nfs4_openowner that is not\nmarked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since\ntwo rpc_task can attempt to open the same file simultaneously from the\nclient to server, and because two instances of nfsd can run\nconcurrently, this situation can lead to lots of memory leak.\nAdditionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be\ntriggered.\n\n NFS SERVER\nnfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads\n\nnfsd4_open\n nfsd4_process_open1\n find_or_alloc_open_stateowner\n // alloc oo1, stateid1\n nfsd4_open\n nfsd4_process_open1\n find_or_alloc_open_stateowner\n // find oo1, without NFS4_OO_CONFIRMED\n release_openowner\n unhash_openowner_locked\n list_del_init(&oo->oo_perclient)\n // cannot find this oo\n // from client, LEAK!!!\n alloc_stateowner // alloc oo2\n\n nfsd4_process_open2\n init_open_stateid\n // associate oo1\n // with stateid1, stateid1 LEAK!!!\n nfs4_get_vfs_file\n // alloc nfsd_file1 and nfsd_file_mark1\n // all LEAK!!!\n\n nfsd4_process_open2\n ...\n\n write_threads\n ...\n nfsd_destroy_serv\n nfsd_shutdown_net\n nfs4_state_shutdown_net\n nfs4_state_destroy_net\n destroy_client\n __destroy_client\n // won't find oo1!!!\n nfsd_shutdown_generic\n nfsd_file_cache_shutdown\n kmem_cache_destroy\n for nfsd_file_slab\n and nfsd_file_mark_slab\n // bark since nfsd_file1\n // and nfsd_file_mark1\n // still alive\n\n=======================================================================\nBUG nfsd_file (Not tainted): Objects remaining in nfsd_file on\n__kmem_cache_shutdown()\n-----------------------------------------------------------------------\n\nSlab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28\nflags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)\nCPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nCall Trace:\n \n dum\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is nfsd's NFSv4 OPEN handler, reached from `svc_process()` → `nfsd_dispatch()` → `nfsd4_proc_compound()` → `nfsd4_open()` on data received from a remote NFS client over routable TCP port 2049. No local access or network adjacency is required.\nAC:L - The attacker owns both sides of the race — it simply opens two TCP connections under one clientid and issues two concurrent NFSv4.0 COMPOUND OPENs carrying the same fresh (unconfirmed) open_owner, and the default 8 nfsd threads guarantee parallel service. The window spans all of `nfsd4_process_open2()` including the VFS open and disk I/O, and a failed attempt costs nothing and can be retried indefinitely.\nPR:N - NFS with the default AUTH_SYS flavour performs no authentication whatsoever — the client self-asserts its uid — so any host permitted by the export list (routinely a whole subnet or `*`) can issue SETCLIENTID, PUTROOTFH/LOOKUP and OPEN with no credentials verified. Nothing on the path to `find_or_alloc_open_stateowner()` checks any capability or privilege.\nUI:N - The attacker's own client issues both concurrent OPEN requests and the later conflicting OPEN entirely on its own initiative; no action by a local user or administrator is needed to trigger the leak or reach the stale stateid.\nS:U - The leaked objects, the dangling `nfs4_client` pointer and any resulting panic all remain inside the kernel's own security authority on the NFS server host. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The leak breaks the invariant that all stateids are destroyed before `free_client()`, leaving `stp->st_stid.sc_client` dangling after routine lease expiry while `stp` keeps `fp` hashed in the global `nfs4_file_rhltable`; a later OPEN with a conflicting share mode reads that freed `nfs4_client` in `nfs4_resolve_deny_conflicts_locked()`. Unauthenticated SETCLIENTID lets the attacker spray `client_slab` to control and observe the reclaimed object, and per kernel guidance a use-after-free is scored High.\nI:H - `try_to_expire_client()` performs a `cmpxchg()` on `clp->cl_state` of the freed, attacker-groomable `nfs4_client`, giving a write primitive into reclaimed heap memory. Additionally the leaked `nfsd_file_mark` survives `nfsd_file_cache_shutdown()` as a live fsnotify mark whose group ops point into nfsd module text, corrupting control flow if the module is later unloaded.\nA:H - Each won race permanently leaks an openowner, stateid, `nfs4_file`, `nfsd_file`, `nfsd_file_mark` and an open `struct file` that pins the inode, dentry and mount, so a remote client looping the race exhausts kernel memory and file references and makes the exported filesystem unmountable. On top of that, `kmem_cache_destroy()` fires `WARN(err, \"Slab cache still has objects…\")` at nfsd shutdown — an immediate panic under `panic_on_warn=1` — and the use-after-free itself crashes the server." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfsd/nfs4state.c" ], "versions": [ { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "a85364f0d30dee01c5d5b4afa55a9629a8f36d8e", "status": "affected", "versionType": "git" }, { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "2d505a801e57428057563762f67a5a62009b2600", "status": "affected", "versionType": "git" }, { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "0ab0a3ad24e970e894abcac58f85c332d1726749", "status": "affected", "versionType": "git" }, { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "45abb68c941ebc9a35c6d3a7b08196712093c636", "status": "affected", "versionType": "git" }, { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "37dfc81266d3a32294524bfadd3396614f8633ee", "status": "affected", "versionType": "git" }, { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "6f73f920b7ad0084373e46121d7ac34117aed652", "status": "affected", "versionType": "git" }, { "version": "3234975f477f746c22d076ea178a79ea104b2ca7", "lessThan": "98100e88dd8865999dc6379a3356cd799795fe7b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfsd/nfs4state.c" ], "versions": [ { "version": "3.17", "status": "affected" }, { "version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.4", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.4.287" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.10.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a85364f0d30dee01c5d5b4afa55a9629a8f36d8e" }, { "url": "https://git.kernel.org/stable/c/2d505a801e57428057563762f67a5a62009b2600" }, { "url": "https://git.kernel.org/stable/c/0ab0a3ad24e970e894abcac58f85c332d1726749" }, { "url": "https://git.kernel.org/stable/c/45abb68c941ebc9a35c6d3a7b08196712093c636" }, { "url": "https://git.kernel.org/stable/c/37dfc81266d3a32294524bfadd3396614f8633ee" }, { "url": "https://git.kernel.org/stable/c/6f73f920b7ad0084373e46121d7ac34117aed652" }, { "url": "https://git.kernel.org/stable/c/98100e88dd8865999dc6379a3356cd799795fe7b" } ], "title": "nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-56779", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:56:28.713212Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:57:24.125Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:54:16.750Z" } } ] } }