{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-56740", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T11:26:39.757Z", "datePublished": "2024-12-29T11:30:09.180Z", "dateUpdated": "2025-05-04T10:03:37.933Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-05-04T10:03:37.933Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs/localio: must clear res.replen in nfs_local_read_done\n\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\nleaving garbage in res.replen:\n- nfs3_read_done() copies that into server->read_hdrsize; from there\n nfs3_proc_read_setup() copies it to args.replen in new requests.\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\n which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\n contains a ridiculous len.\n- This is copied to rq_private_buf and xs_read_stream_request()\n eventually passes the kvec to sock_recvmsg() which receives incoming\n data into entirely the wrong place.\n\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\nwhen it is made to pivot back to using normal RPC. This switch back\nto using normal NFSv3 with RPC can occur for a few reasons but this\nissue was exposed with a test that stops and then restarts the NFSv3\nserver while LOCALIO is performing heavy read IO."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/localio.c"], "versions": [{"version": "70ba381e1a431245c137ed597ec6a05991c79bd9", "lessThan": "de5dac261eeab99762bbdf7c20cee5d26ef4462e", "status": "affected", "versionType": "git"}, {"version": "70ba381e1a431245c137ed597ec6a05991c79bd9", "lessThan": "650703bc4ed3edf841e851c99ab8e7ba9e5262a3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/localio.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e"}, {"url": "https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3"}], "title": "nfs/localio: must clear res.replen in nfs_local_read_done", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776", "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs/localio: must clear res.replen in nfs_local_read_done\n\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\nleaving garbage in res.replen:\n- nfs3_read_done() copies that into server->read_hdrsize; from there\n nfs3_proc_read_setup() copies it to args.replen in new requests.\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\n which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\n contains a ridiculous len.\n- This is copied to rq_private_buf and xs_read_stream_request()\n eventually passes the kvec to sock_recvmsg() which receives incoming\n data into entirely the wrong place.\n\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\nwhen it is made to pivot back to using normal RPC. This switch back\nto using normal NFSv3 with RPC can occur for a few reasons but this\nissue was exposed with a test that stops and then restarts the NFSv3\nserver while LOCALIO is performing heavy read IO."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfs/localio: debe borrar res.replen en nfs_local_read_done De lo contrario, puede producirse corrupci\u00f3n de memoria debido a que las lecturas LOCALIO de NFSv3 dejan basura en res.replen: - nfs3_read_done() copia eso en server->read_hdrsize; desde all\u00ed, nfs3_proc_read_setup() lo copia en args.replen en nuevas solicitudes. - nfs3_xdr_enc_read3args() pasa eso a rpc_prepare_reply_pages() que lo incluye en hdrsize para xdr_init_pages, de modo que rq_rcv_buf contiene una longitud rid\u00edcula. - Esto se copia a rq_private_buf y xs_read_stream_request() eventualmente pasa el kvec a sock_recvmsg() que recibe datos entrantes en un lugar completamente equivocado. Esto se reproduce f\u00e1cilmente con NFSv3 LOCALIO, que est\u00e1 prestando servicio a las lecturas, cuando se le obliga a volver a utilizar RPC normal. Este cambio a utilizar NFSv3 normal con RPC puede ocurrir por varias razones, pero este problema se expuso con una prueba que detiene y luego reinicia el servidor NFSv3 mientras LOCALIO realiza operaciones de E/S de lectura pesadas."}], "id": "CVE-2024-56740", "lastModified": "2025-01-07T22:24:05.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-12-29T12:15:07.360", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nfs/localio: must clear res.replen in nfs_local_read_done", "id": "2334823", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334823"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfs/localio: must clear res.replen in nfs_local_read_done\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\nleaving garbage in res.replen:\n- nfs3_read_done() copies that into server->read_hdrsize; from there\nnfs3_proc_read_setup() copies it to args.replen in new requests.\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\nwhich includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\ncontains a ridiculous len.\n- This is copied to rq_private_buf and xs_read_stream_request()\neventually passes the kvec to sock_recvmsg() which receives incoming\ndata into entirely the wrong place.\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\nwhen it is made to pivot back to using normal RPC. This switch back\nto using normal NFSv3 with RPC can occur for a few reasons but this\nissue was exposed with a test that stops and then restarts the NFSv3\nserver while LOCALIO is performing heavy read IO."], "name": "CVE-2024-56740", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56740\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56740\nhttps://lore.kernel.org/linux-cve-announce/2024122925-CVE-2024-56740-6b7b@gregkh/T"], "threat_severity": "Important"}