{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:07:08.535058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:07:22.328Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b46a871e980e3daa16fd5e77539966492e8910a",
              "status": "affected",
              "version": "c5967721e1063648b0506481585ba7e2e49a075e",
              "versionType": "git"
            },
            {
              "lessThan": "40927f3d0972bf86357a32a5749be71a551241b6",
              "status": "affected",
              "version": "c5967721e1063648b0506481585ba7e2e49a075e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease\n\nIt is not safe to dereference fl-\u003ec.flc_owner without first confirming\nfl-\u003efl_lmops is the expected manager.  nfsd4_deleg_getattr_conflict()\ntests fl_lmops but largely ignores the result and assumes that flc_owner\nis an nfs4_delegation anyway.  This is wrong.\n\nWith this patch we restore the \"!= \u0026nfsd_lease_mng_ops\" case to behave\nas it did before the change mentioned below.  This is the same as the\ncurrent code, but without any reference to a possible delegation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable function is in the in-kernel NFS server and is reached purely by an NFSv4 COMPOUND GETATTR requesting the change or size attribute over TCP port 2049. No local access to the server is required to drive the confused dereference.\nAC:L - The trigger (GETATTR for size/change on a chosen file) is issued at will and repeatably, and the required non-nfsd F_WRLCK lease is attacker-creatable in the standard multiprotocol NAS deployment the commit describes \u2014 the same tree exported via Samba, which takes fcntl(F_SETLEASE, F_WRLCK) kernel oplocks on behalf of an SMB client. The attacker therefore controls both the precondition and the trigger; no timing window or unknowable memory state must be guessed.\nPR:N - NFS AUTH_SYS verifies no credentials \u2014 any host permitted by the export list simply asserts a uid, and CVSS does not treat network-level export ACLs as a privilege. Issuing a GETATTR for size/change requires nothing beyond a mount of an ordinary export.\nUI:N - The attacker drives both the lease-establishing open and the GETATTR itself; no action by any legitimate user or administrator is needed.\nS:U - The type confusion corrupts kernel slab memory within the same security authority as the nfsd server; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `*size = ncf-\u003encf_cur_fsize` reads 8 bytes roughly 400 bytes past the end of the 232-byte struct file and encodes them into the FATTR4_SIZE field of the GETATTR reply, directly disclosing adjacent kernel heap contents to the remote client, on top of the OOB pointer reads of `cb_clp`/`cb_ops`.\nI:H - The path performs multiple out-of-bounds writes into the neighbouring slab object (`test_and_set_bit` on ncf_cb_flags, the u32 ncf_cb_status store, the u64 ncf_cur_fsize store, the ncf_file_modified byte) plus a refcount_inc over struct file\u0027s first word, and reaches an indirect call through `s-\u003esc_free` and `cb-\u003ecb_ops` read from confused/OOB memory \u2014 a groomable control-flow hijack primitive.\nA:H - `nfsd4_run_cb()` dereferences `clp` read from out-of-bounds memory and calls queue_work() on an uninitialized work_struct, and nfs4_put_stid() spin_locks a garbage pointer, so a single GETATTR reliably oopses or panics the NFS file server and can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:58.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a"
        },
        {
          "url": "https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6"
        }
      ],
      "title": "nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46690",
    "datePublished": "2024-09-13T05:29:20.368Z",
    "dateReserved": "2024-09-11T15:12:18.249Z",
    "dateUpdated": "2026-08-05T11:37:58.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}