CVE-2024-46697CWE-665

CVE-2024-46697

Critical · published September 13, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
34.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nfsd: ensure that nfsd4_fattr_args.context is zeroed out

If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to

checking for the security label, then args.context will be set to

uninitialized junk on the stack, which we'll then try to free.

Initialize it early.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.9th percentile
Weakness
CWE-665 · Improper Initialization
Published
2024-09-13T10:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.7, < 6.10.86.10.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 13 SEP 05:29Z
    nfsd: ensure that nfsd4_fattr_args.context is zeroed out
    cvelistv5