CVE-2024-49999 (GCVE-0-2024-49999)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:02 – Updated: 2026-08-05 11:41
VLAI
Title
afs: Fix the setting of the server responding flag
Summary
In the Linux kernel, the following vulnerability has been resolved: afs: Fix the setting of the server responding flag In afs_wait_for_operation(), we set transcribe the call responded flag to the server record that we used after doing the fileserver iteration loop - but it's possible to exit the loop having had a response from the server that we've discarded (e.g. it returned an abort or we started receiving data, but the call didn't complete). This means that op->server might be NULL, but we don't check that before attempting to set the server flag.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 98f9fda2057ba34b720c4d353351024d6dcee90f , < 3d51ab44123f35dd1d646d99a15ebef10f55e263 (git)
Affected: 98f9fda2057ba34b720c4d353351024d6dcee90f , < 97c953572d98080c5f1486155350bb688041747a (git)
Affected: 98f9fda2057ba34b720c4d353351024d6dcee90f , < ff98751bae40faed1ba9c6a7287e84430f7dec64 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:30:13.693852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:41.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/fs_operation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d51ab44123f35dd1d646d99a15ebef10f55e263",
              "status": "affected",
              "version": "98f9fda2057ba34b720c4d353351024d6dcee90f",
              "versionType": "git"
            },
            {
              "lessThan": "97c953572d98080c5f1486155350bb688041747a",
              "status": "affected",
              "version": "98f9fda2057ba34b720c4d353351024d6dcee90f",
              "versionType": "git"
            },
            {
              "lessThan": "ff98751bae40faed1ba9c6a7287e84430f7dec64",
              "status": "affected",
              "version": "98f9fda2057ba34b720c4d353351024d6dcee90f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/afs/fs_operation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix the setting of the server responding flag\n\nIn afs_wait_for_operation(), we set transcribe the call responded flag to\nthe server record that we used after doing the fileserver iteration loop -\nbut it\u0027s possible to exit the loop having had a response from the server\nthat we\u0027ve discarded (e.g. it returned an abort or we started receiving\ndata, but the call didn\u0027t complete).\n\nThis means that op-\u003eserver might be NULL, but we don\u0027t check that before\nattempting to set the server flag."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the kAFS network filesystem client and is driven entirely by responses received from remote AFS fileservers and VL servers over RxRPC/UDP; a malicious/compromised fileserver in the cell, or an on-path attacker spoofing the unauthenticated (rxnull, the default for anonymous access) RxRPC abort/response packets, reaches it across the network.\nAC:L - No local access or adjacency is required \u2014 AFS cells are routinely accessed over routed/internet paths. The attacker controls both halves of the condition: it makes the call \"respond\" (return a VMOVED/other abort, or start data then stall) and then makes the subsequent volume-status/VL step fail so the rotation loop exits at `failed:` with `op-\u003eserver` already NULLed by `restart_from_beginning`. This is deterministic and can be repeated at will, requiring no memory-layout or timing luck.\nPR:N - The attacker needs no account or credentials on the victim system; it acts purely as a network peer, and kAFS talks to fileservers anonymously by default (no kerberos key required for the affected RPC/abort handling).\nUI:N - On an AFS-using host /afs is mounted at boot, and RPCs that traverse afs_wait_for_operation() are issued continuously by background writeback, callback-driven revalidation, and periodic volume-record updates from kworkers \u2014 no victim action is needed for the malicious server response to be processed.\nS:U - The faulting write and its consequences are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a NULL-pointer write (set_bit at a fixed small offset within struct afs_server); nothing is read from or leaked out of kernel memory.\nI:N - The only write targets a fixed low address in the unmapped zero page with attacker-uncontrolled content (bit 0), so it faults rather than modifying any kernel data; no integrity impact results.\nA:H - It is a kernel oops (panic with panic_on_oops), and because the fault occurs before afs_end_vnode_operation()/afs_drop_io_locks() the dying task leaks vnode-\u003eio_lock mutexes, leaving the AFS mount permanently wedged with unkillable D-state waiters; a remote attacker can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:00.098Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d51ab44123f35dd1d646d99a15ebef10f55e263"
        },
        {
          "url": "https://git.kernel.org/stable/c/97c953572d98080c5f1486155350bb688041747a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff98751bae40faed1ba9c6a7287e84430f7dec64"
        }
      ],
      "title": "afs: Fix the setting of the server responding flag",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49999",
    "datePublished": "2024-10-21T18:02:38.958Z",
    "dateReserved": "2024-10-21T12:17:06.057Z",
    "dateUpdated": "2026-08-05T11:41:00.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49999",
      "date": "2026-08-05",
      "epss": "0.00572",
      "percentile": "0.44075"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49999\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:19.973\",\"lastModified\":\"2026-06-17T08:00:54.620\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nafs: Fix the setting of the server responding flag\\n\\nIn afs_wait_for_operation(), we set transcribe the call responded flag to\\nthe server record that we used after doing the fileserver iteration loop -\\nbut it\u0027s possible to exit the loop having had a response from the server\\nthat we\u0027ve discarded (e.g. it returned an abort or we started receiving\\ndata, but the call didn\u0027t complete).\\n\\nThis means that op-\u003eserver might be NULL, but we don\u0027t check that before\\nattempting to set the server flag.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: afs: Arreglar la configuraci\u00f3n del indicador de respuesta del servidor En afs_wait_for_operation(), configuramos la transcripci\u00f3n del indicador de respuesta de llamada en el registro del servidor que usamos despu\u00e9s de realizar el bucle de iteraci\u00f3n del servidor de archivos, pero es posible salir del bucle despu\u00e9s de haber recibido una respuesta del servidor que descartamos (por ejemplo, devolvi\u00f3 un aborto o comenzamos a recibir datos, pero la llamada no se complet\u00f3). Esto significa que op-\u0026gt;server podr\u00eda ser NULL, pero no lo verificamos antes de intentar configurar el indicador del servidor.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/afs/fs_operation.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98f9fda2057ba34b720c4d353351024d6dcee90f\",\"lessThan\":\"3d51ab44123f35dd1d646d99a15ebef10f55e263\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98f9fda2057ba34b720c4d353351024d6dcee90f\",\"lessThan\":\"97c953572d98080c5f1486155350bb688041747a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98f9fda2057ba34b720c4d353351024d6dcee90f\",\"lessThan\":\"ff98751bae40faed1ba9c6a7287e84430f7dec64\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/afs/fs_operation.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:30:13.693852Z\",\"id\":\"CVE-2024-49999\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"0E3AE738-A62B-4806-9D9C-933998214C6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d51ab44123f35dd1d646d99a15ebef10f55e263\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97c953572d98080c5f1486155350bb688041747a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff98751bae40faed1ba9c6a7287e84430f7dec64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:47:27+00:00",
      "cve": "CVE-2024-49999",
      "id": "CVE-2024-49999",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: afs: Fix the setting of the server responding flag",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49999.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49999\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:30:13.693852Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:30:16.844Z\"}}], \"cna\": {\"title\": \"afs: Fix the setting of the server responding flag\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"98f9fda2057b\", \"lessThan\": \"3d51ab44123f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98f9fda2057b\", \"lessThan\": \"97c953572d98\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98f9fda2057b\", \"lessThan\": \"ff98751bae40\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/afs/fs_operation.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12-rc2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/afs/fs_operation.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3d51ab44123f35dd1d646d99a15ebef10f55e263\"}, {\"url\": \"https://git.kernel.org/stable/c/97c953572d98080c5f1486155350bb688041747a\"}, {\"url\": \"https://git.kernel.org/stable/c/ff98751bae40faed1ba9c6a7287e84430f7dec64\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nafs: Fix the setting of the server responding flag\\n\\nIn afs_wait_for_operation(), we set transcribe the call responded flag to\\nthe server record that we used after doing the fileserver iteration loop -\\nbut it\u0027s possible to exit the loop having had a response from the server\\nthat we\u0027ve discarded (e.g. it returned an abort or we started receiving\\ndata, but the call didn\u0027t complete).\\n\\nThis means that op-\u003eserver might be NULL, but we don\u0027t check that before\\nattempting to set the server flag.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:53:13.179Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49999\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:53:13.179Z\", \"dateReserved\": \"2024-10-21T12:17:06.057Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:38.958Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.