CVE-2024-36958

CVE-2024-36958

Critical · published May 30, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix nfsd4_encode_fattr4() crasher

Ensure that args.acl is initialized early. It is used in an

unconditional call to kfree() on the way out of

nfsd4_encode_fattr4().

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.5th percentile
Published
2024-05-30T20:15Z
Affected products (16)
ProductVersionsFixed in
linux/linux_kernel≥ 6.7, < 6.8.106.8.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
netapp/converged_systems_advisor_agentall versions—
netapp/solidfire_\&_hci_management_nodeall versions—
netapp/solidfire_\&_hci_storage_nodeall versions—
netapp/hci_compute_nodeall versions—
netapp/h300s_firmwareall versions—
netapp/h500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h410c_firmwareall versions—
netapp/h410s_firmwareall versions—
References (5)
https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20250404-0007/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 30 MAY 15:35Z
    NFSD: Fix nfsd4_encode_fattr4() crasher
    cvelistv5