CVE-2024-53217

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53217
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03178cd8f67227015debb700123987fe96275cd1 Patch
https://git.kernel.org/stable/c/0c3b0e326f838787d229314d4de83af9c53347e8 Patch
https://git.kernel.org/stable/c/1e02c641c3a43c88cecc08402000418e15578d38 Patch
https://git.kernel.org/stable/c/4a4ffc1aa9d618e41ad9151f40966e402e58a5a2 Patch
https://git.kernel.org/stable/c/752a75811f27300fe8131b0a1efc91960f6f88e7 Patch
https://git.kernel.org/stable/c/c5d90f9302742985a5078e42ac38de42c364c44a Patch
https://git.kernel.org/stable/c/cac1405e3ff6685a438e910ad719e0cf06af90ee Patch
https://git.kernel.org/stable/c/d9a0d1f6e15859ea7a86a327f28491e23deaaa62 Patch
https://git.kernel.org/stable/c/eb51733ae5fc73d95bd857d5da26f9f65b202a79 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

31 Jan 2025, 15:59

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CWE CWE-476
References () https://git.kernel.org/stable/c/03178cd8f67227015debb700123987fe96275cd1 - () https://git.kernel.org/stable/c/03178cd8f67227015debb700123987fe96275cd1 - Patch
References () https://git.kernel.org/stable/c/0c3b0e326f838787d229314d4de83af9c53347e8 - () https://git.kernel.org/stable/c/0c3b0e326f838787d229314d4de83af9c53347e8 - Patch
References () https://git.kernel.org/stable/c/1e02c641c3a43c88cecc08402000418e15578d38 - () https://git.kernel.org/stable/c/1e02c641c3a43c88cecc08402000418e15578d38 - Patch
References () https://git.kernel.org/stable/c/4a4ffc1aa9d618e41ad9151f40966e402e58a5a2 - () https://git.kernel.org/stable/c/4a4ffc1aa9d618e41ad9151f40966e402e58a5a2 - Patch
References () https://git.kernel.org/stable/c/752a75811f27300fe8131b0a1efc91960f6f88e7 - () https://git.kernel.org/stable/c/752a75811f27300fe8131b0a1efc91960f6f88e7 - Patch
References () https://git.kernel.org/stable/c/c5d90f9302742985a5078e42ac38de42c364c44a - () https://git.kernel.org/stable/c/c5d90f9302742985a5078e42ac38de42c364c44a - Patch
References () https://git.kernel.org/stable/c/cac1405e3ff6685a438e910ad719e0cf06af90ee - () https://git.kernel.org/stable/c/cac1405e3ff6685a438e910ad719e0cf06af90ee - Patch
References () https://git.kernel.org/stable/c/d9a0d1f6e15859ea7a86a327f28491e23deaaa62 - () https://git.kernel.org/stable/c/d9a0d1f6e15859ea7a86a327f28491e23deaaa62 - Patch
References () https://git.kernel.org/stable/c/eb51733ae5fc73d95bd857d5da26f9f65b202a79 - () https://git.kernel.org/stable/c/eb51733ae5fc73d95bd857d5da26f9f65b202a79 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSD: evitar la desreferenciación de NULL en nfsd4_process_cb_update() @ses se inicializa a NULL. Si __nfsd4_find_backchannel() no encuentra ninguna sesión de backchannel disponible, setup_callback_client() intentará desreferenciar @ses y generar una violación de segmentación.

27 Dec 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 14:15

Updated : 2025-01-31 15:59

NVD link : CVE-2024-53217

Mitre link : CVE-2024-53217

CVE.ORG link : CVE-2024-53217

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference