CVE-2024-56740 (GCVE-0-2024-56740)

Vulnerability from cvelistv5 – Published: 2024-12-29 11:30 – Updated: 2026-08-05 11:46
VLAI
Title
nfs/localio: must clear res.replen in nfs_local_read_done
Summary
In the Linux kernel, the following vulnerability has been resolved: nfs/localio: must clear res.replen in nfs_local_read_done Otherwise memory corruption can occur due to NFSv3 LOCALIO reads leaving garbage in res.replen: - nfs3_read_done() copies that into server->read_hdrsize; from there nfs3_proc_read_setup() copies it to args.replen in new requests. - nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages() which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf contains a ridiculous len. - This is copied to rq_private_buf and xs_read_stream_request() eventually passes the kvec to sock_recvmsg() which receives incoming data into entirely the wrong place. This is easily reproduced with NFSv3 LOCALIO that is servicing reads when it is made to pivot back to using normal RPC. This switch back to using normal NFSv3 with RPC can occur for a few reasons but this issue was exposed with a test that stops and then restarts the NFSv3 server while LOCALIO is performing heavy read IO.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 70ba381e1a431245c137ed597ec6a05991c79bd9 , < de5dac261eeab99762bbdf7c20cee5d26ef4462e (git)
Affected: 70ba381e1a431245c137ed597ec6a05991c79bd9 , < 650703bc4ed3edf841e851c99ab8e7ba9e5262a3 (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:57:38.126609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:04.078Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/localio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "de5dac261eeab99762bbdf7c20cee5d26ef4462e",
              "status": "affected",
              "version": "70ba381e1a431245c137ed597ec6a05991c79bd9",
              "versionType": "git"
            },
            {
              "lessThan": "650703bc4ed3edf841e851c99ab8e7ba9e5262a3",
              "status": "affected",
              "version": "70ba381e1a431245c137ed597ec6a05991c79bd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/localio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs/localio: must clear res.replen in nfs_local_read_done\n\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\nleaving garbage in res.replen:\n- nfs3_read_done() copies that into server-\u003eread_hdrsize; from there\n  nfs3_proc_read_setup() copies it to args.replen in new requests.\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\n  which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\n  contains a ridiculous len.\n- This is copied to rq_private_buf and xs_read_stream_request()\n  eventually passes the kvec to sock_recvmsg() which receives incoming\n  data into entirely the wrong place.\n\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\nwhen it is made to pivot back to using normal RPC.  This switch back\nto using normal NFSv3 with RPC can occur for a few reasons but this\nissue was exposed with a test that stops and then restarts the NFSv3\nserver while LOCALIO is performing heavy read IO."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - LOCALIO is only negotiated when the NFS client and nfsd run on the same host, so the RPC transport whose receive path is misdirected is host-local; exploitation requires a local process to read files over that mount and to induce the LOCALIO-to-RPC pivot. A remote NFS client can supply the file bytes that end up splattered over the slab, but cannot itself reach or trigger the corrupting path.\nAC:L - The poisoning is deterministic \u2014 the very first successful LOCALIO read latches a heap-pointer value into server-\u003eread_hdrsize via cmpxchg, and every subsequent RPC read then misdirects sock_recvmsg; the upstream commit states it is \"easily reproduced\". The pivot back to RPC is reachable through attacker-inducible conditions such as memory pressure causing nfs_local_open_fh() to fail with -ENOMEM.\nPR:L - An unprivileged local user with access to the existing LOCALIO-enabled NFS mount can perform the reads that both poison read_hdrsize and later trigger the out-of-bounds receive, and can drive the memory pressure that forces the fallback to RPC. No capabilities are needed once the mount is present.\nUI:N - Exploitation only requires ordinary read I/O on an already-mounted NFS filesystem; no administrator or victim action beyond routine file access is needed.\nS:U - The corruption is confined to kernel slab memory within the same security authority as the vulnerable component; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The corrupted xdr_buf leaves tail-\u003eiov_base pointing far outside the RPC buffer with an underflowed tail-\u003eiov_len, so subsequent XDR decode reads out-of-bounds kernel memory and can surface it to userspace as read data; a slab overflow of this size is readily leveraged into an arbitrary-read primitive.\nI:H - sock_recvmsg() writes up to rsize bytes (hundreds of KB) of server-supplied file data linearly past a small rpc_buffer slab object, and the corrupted tail kvec adds a wild-pointer write \u2014 a controllable heap overflow suitable for control-flow hijacking.\nA:H - Overrunning the rpc_buffer slab by hundreds of kilobytes destroys adjacent kernel objects and reliably produces oops/panic or slab corruption, halting the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:20.277Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e"
        },
        {
          "url": "https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3"
        }
      ],
      "title": "nfs/localio: must clear res.replen in nfs_local_read_done",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56740",
    "datePublished": "2024-12-29T11:30:09.180Z",
    "dateReserved": "2024-12-29T11:26:39.757Z",
    "dateUpdated": "2026-08-05T11:46:20.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56740",
      "date": "2026-08-09",
      "epss": "0.00197",
      "percentile": "0.09597"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.12\", \"versionEndExcluding\": \"6.12.2\", \"matchCriteriaId\": \"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfs/localio: must clear res.replen in nfs_local_read_done\\n\\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\\nleaving garbage in res.replen:\\n- nfs3_read_done() copies that into server-\u003eread_hdrsize; from there\\n  nfs3_proc_read_setup() copies it to args.replen in new requests.\\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\\n  which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\\n  contains a ridiculous len.\\n- This is copied to rq_private_buf and xs_read_stream_request()\\n  eventually passes the kvec to sock_recvmsg() which receives incoming\\n  data into entirely the wrong place.\\n\\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\\nwhen it is made to pivot back to using normal RPC.  This switch back\\nto using normal NFSv3 with RPC can occur for a few reasons but this\\nissue was exposed with a test that stops and then restarts the NFSv3\\nserver while LOCALIO is performing heavy read IO.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfs/localio: debe borrar res.replen en nfs_local_read_done De lo contrario, puede producirse corrupci\\u00f3n de memoria debido a que las lecturas LOCALIO de NFSv3 dejan basura en res.replen: - nfs3_read_done() copia eso en server-\u0026gt;read_hdrsize; desde all\\u00ed, nfs3_proc_read_setup() lo copia en args.replen en nuevas solicitudes. - nfs3_xdr_enc_read3args() pasa eso a rpc_prepare_reply_pages() que lo incluye en hdrsize para xdr_init_pages, de modo que rq_rcv_buf contiene una longitud rid\\u00edcula. - Esto se copia a rq_private_buf y xs_read_stream_request() eventualmente pasa el kvec a sock_recvmsg() que recibe datos entrantes en un lugar completamente equivocado. Esto se reproduce f\\u00e1cilmente con NFSv3 LOCALIO, que est\\u00e1 prestando servicio a las lecturas, cuando se le obliga a volver a utilizar RPC normal. Este cambio a utilizar NFSv3 normal con RPC puede ocurrir por varias razones, pero este problema se expuso con una prueba que detiene y luego reinicia el servidor NFSv3 mientras LOCALIO realiza operaciones de E/S de lectura pesadas.\"}]",
      "id": "CVE-2024-56740",
      "lastModified": "2025-01-07T22:24:05.593",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-12-29T12:15:07.360",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56740\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-29T12:15:07.360\",\"lastModified\":\"2026-06-17T08:12:52.720\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfs/localio: must clear res.replen in nfs_local_read_done\\n\\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\\nleaving garbage in res.replen:\\n- nfs3_read_done() copies that into server-\u003eread_hdrsize; from there\\n  nfs3_proc_read_setup() copies it to args.replen in new requests.\\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\\n  which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\\n  contains a ridiculous len.\\n- This is copied to rq_private_buf and xs_read_stream_request()\\n  eventually passes the kvec to sock_recvmsg() which receives incoming\\n  data into entirely the wrong place.\\n\\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\\nwhen it is made to pivot back to using normal RPC.  This switch back\\nto using normal NFSv3 with RPC can occur for a few reasons but this\\nissue was exposed with a test that stops and then restarts the NFSv3\\nserver while LOCALIO is performing heavy read IO.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfs/localio: debe borrar res.replen en nfs_local_read_done De lo contrario, puede producirse corrupci\u00f3n de memoria debido a que las lecturas LOCALIO de NFSv3 dejan basura en res.replen: - nfs3_read_done() copia eso en server-\u0026gt;read_hdrsize; desde all\u00ed, nfs3_proc_read_setup() lo copia en args.replen en nuevas solicitudes. - nfs3_xdr_enc_read3args() pasa eso a rpc_prepare_reply_pages() que lo incluye en hdrsize para xdr_init_pages, de modo que rq_rcv_buf contiene una longitud rid\u00edcula. - Esto se copia a rq_private_buf y xs_read_stream_request() eventualmente pasa el kvec a sock_recvmsg() que recibe datos entrantes en un lugar completamente equivocado. Esto se reproduce f\u00e1cilmente con NFSv3 LOCALIO, que est\u00e1 prestando servicio a las lecturas, cuando se le obliga a volver a utilizar RPC normal. Este cambio a utilizar NFSv3 normal con RPC puede ocurrir por varias razones, pero este problema se expuso con una prueba que detiene y luego reinicia el servidor NFSv3 mientras LOCALIO realiza operaciones de E/S de lectura pesadas.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/localio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"70ba381e1a431245c137ed597ec6a05991c79bd9\",\"lessThan\":\"de5dac261eeab99762bbdf7c20cee5d26ef4462e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"70ba381e1a431245c137ed597ec6a05991c79bd9\",\"lessThan\":\"650703bc4ed3edf841e851c99ab8e7ba9e5262a3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/localio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:57:38.126609Z\",\"id\":\"CVE-2024-56740\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2025-11-21T13:58:05+00:00",
      "cve": "CVE-2024-56740",
      "id": "CVE-2024-56740",
      "initial_release_date": "2024-12-29T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfs/localio: must clear res.replen in nfs_local_read_done",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56740.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:48:48Z",
      "cve": "CVE-2024-56740",
      "id": "CVE-2024-56740",
      "initial_release_date": "2024-12-30T03:48:20Z",
      "product_status:known_not_affected": "438",
      "product_status:recommended": "53",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56740",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56740.json",
      "version": "22"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:57:38.126609Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:49:15.316Z\"}}], \"cna\": {\"title\": \"nfs/localio: must clear res.replen in nfs_local_read_done\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - LOCALIO is only negotiated when the NFS client and nfsd run on the same host, so the RPC transport whose receive path is misdirected is host-local; exploitation requires a local process to read files over that mount and to induce the LOCALIO-to-RPC pivot. A remote NFS client can supply the file bytes that end up splattered over the slab, but cannot itself reach or trigger the corrupting path.\\nAC:L - The poisoning is deterministic \\u2014 the very first successful LOCALIO read latches a heap-pointer value into server-\u003eread_hdrsize via cmpxchg, and every subsequent RPC read then misdirects sock_recvmsg; the upstream commit states it is \\\"easily reproduced\\\". The pivot back to RPC is reachable through attacker-inducible conditions such as memory pressure causing nfs_local_open_fh() to fail with -ENOMEM.\\nPR:L - An unprivileged local user with access to the existing LOCALIO-enabled NFS mount can perform the reads that both poison read_hdrsize and later trigger the out-of-bounds receive, and can drive the memory pressure that forces the fallback to RPC. No capabilities are needed once the mount is present.\\nUI:N - Exploitation only requires ordinary read I/O on an already-mounted NFS filesystem; no administrator or victim action beyond routine file access is needed.\\nS:U - The corruption is confined to kernel slab memory within the same security authority as the vulnerable component; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The corrupted xdr_buf leaves tail-\u003eiov_base pointing far outside the RPC buffer with an underflowed tail-\u003eiov_len, so subsequent XDR decode reads out-of-bounds kernel memory and can surface it to userspace as read data; a slab overflow of this size is readily leveraged into an arbitrary-read primitive.\\nI:H - sock_recvmsg() writes up to rsize bytes (hundreds of KB) of server-supplied file data linearly past a small rpc_buffer slab object, and the corrupted tail kvec adds a wild-pointer write \\u2014 a controllable heap overflow suitable for control-flow hijacking.\\nA:H - Overrunning the rpc_buffer slab by hundreds of kilobytes destroys adjacent kernel objects and reliably produces oops/panic or slab corruption, halting the system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"70ba381e1a431245c137ed597ec6a05991c79bd9\", \"lessThan\": \"de5dac261eeab99762bbdf7c20cee5d26ef4462e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"70ba381e1a431245c137ed597ec6a05991c79bd9\", \"lessThan\": \"650703bc4ed3edf841e851c99ab8e7ba9e5262a3\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfs/localio.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfs/localio.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e\"}, {\"url\": \"https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfs/localio: must clear res.replen in nfs_local_read_done\\n\\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\\nleaving garbage in res.replen:\\n- nfs3_read_done() copies that into server-\u003eread_hdrsize; from there\\n  nfs3_proc_read_setup() copies it to args.replen in new requests.\\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\\n  which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\\n  contains a ridiculous len.\\n- This is copied to rq_private_buf and xs_read_stream_request()\\n  eventually passes the kvec to sock_recvmsg() which receives incoming\\n  data into entirely the wrong place.\\n\\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\\nwhen it is made to pivot back to using normal RPC.  This switch back\\nto using normal NFSv3 with RPC can occur for a few reasons but this\\nissue was exposed with a test that stops and then restarts the NFSv3\\nserver while LOCALIO is performing heavy read IO.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:20.277Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:20.277Z\", \"dateReserved\": \"2024-12-29T11:26:39.757Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-29T11:30:09.180Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.