Vulnerability-Lookup

GHSA-F552-2543-6V42

Vulnerability from github – Published: 2024-05-19 09:34 – Updated: 2025-09-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Fix error cleanup path in nfsd_rename()

Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-35914"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-667"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-19T09:15:11Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection.",
  "id": "GHSA-f552-2543-6v42",
  "modified": "2025-09-23T15:31:04Z",
  "published": "2024-05-19T09:34:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35914"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-35914 (GCVE-0-2024-35914)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:35 – Updated: 2026-08-05 11:30

Title

nfsd: Fix error cleanup path in nfsd_rename()

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-18 16:53 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6843 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/331e125e02c08ffae…
https://git.kernel.org/stable/c/9fe6e9e7b58944037…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a8b0026847b8c43445c921ad2c85521c92eb175f , < 331e125e02c08ffaecc1074af78a988a278039bd (git) Affected: a8b0026847b8c43445c921ad2c85521c92eb175f , < 9fe6e9e7b58944037714442384075c17cfde1c56 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.8.5 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T16:53:51.345113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T16:54:02.746Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "331e125e02c08ffaecc1074af78a988a278039bd",
              "status": "affected",
              "version": "a8b0026847b8c43445c921ad2c85521c92eb175f",
              "versionType": "git"
            },
            {
              "lessThan": "9fe6e9e7b58944037714442384075c17cfde1c56",
              "status": "affected",
              "version": "a8b0026847b8c43445c921ad2c85521c92eb175f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached purely by sending an NFSv2/v3 RENAME RPC or an NFSv4 COMPOUND containing RENAME over TCP/2049. No local access to the server is needed.\nAC:L - The remote client supplies both directory filehandles itself and can retry the request an unbounded number of times; nfsd explicitly tolerates DCACHE_DISCONNECTED directory dentries (it only warns), so the lock_rename() -EXDEV bail-out is reachable from client-controlled input rather than depending on a condition the attacker cannot influence.\nPR:N - With the standard AUTH_SYS/AUTH_UNIX export configuration nfsd performs no cryptographic authentication \u2014 the client asserts its own uid/gid, so the fh_verify() NFSD_MAY_REMOVE/NFSD_MAY_CREATE checks are satisfied by a self-declared identity. Any host permitted by the export list can trigger it with no privileges on the server.\nUI:N - The attacking NFS client drives the entire sequence itself by issuing RENAME requests; no administrator or user action on the server is required.\nS:U - The leaked mnt_want_write()/sb_start_write() reference affects only the exported filesystem within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an unbalanced mount write-access/freeze-protection reference on an error path; no memory is read out of bounds, no kernel pointer or file content is exposed, and the rename itself never executes.\nI:N - Nothing is written or modified \u2014 the operation fails with NFS3ERR_XDEV/NFSERR_ACCES and returns; there is no memory corruption or arbitrary-write primitive of any kind.\nA:H - The error path returns while still holding the export\u0027s remount/freeze protection, and a remote client can drive it repeatedly across concurrent connections to keep write references pinned on the exported filesystem, indefinitely stalling fsfreeze and remount-read-only (snapshot/backup) operations on that mount."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:56.369Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"
        }
      ],
      "title": "nfsd: Fix error cleanup path in nfsd_rename()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35914",
    "datePublished": "2024-05-19T08:35:07.367Z",
    "dateReserved": "2024-05-17T13:50:33.122Z",
    "dateUpdated": "2026-08-05T11:30:56.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted