CVE-2024-46697

Published: Sep 13, 2024Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to uninitialized junk on the stack, which we'll then try to free. Initialize it early.

Affected (6)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 6.7 to 6.10.8
Linux Linux Kernel	Version 6.11 rc1
Linux Linux Kernel	Version 6.11 rc2
Linux Linux Kernel	Version 6.11 rc3
Linux Linux Kernel	Version 6.11 rc4
Linux Linux Kernel	Version 6.11 rc5

Related CWEs

CWE-665

Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

References (2)

https://git.kernel.org/stable/c/dd65b324174a64558a16ebbf4c3266e5701185d0

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/f58bab6fd4063913bd8321e99874b8239e9ba726

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

Timeline

No history available yet.