CVE-2024-46690

nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to dereference fl->c.flc_owner without first confirming fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() tests fl_lmops but largely ignores the result and assumes that flc_owner is an nfs4_delegation anyway. This is wrong. With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave as it did before the change mentioned below. This is the same as the current code, but without any reference to a possible delegation.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a	patch
https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6	patch

Frequently Asked Questions

What is the severity of CVE-2024-46690?: CVE-2024-46690 has been scored as a medium severity vulnerability.
How to fix CVE-2024-46690?: To fix CVE-2024-46690, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-46690 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-46690 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-46690?: CVE-2024-46690 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.