CVE-2024-35882

What it actually does

A memory leak occurs in the SUNRPC layer when handling RPC-over-TCP responses because the record marker page fragment is not released by svc_xprt_release(), leading to gradual exhaustion of kernel memory on affected servers.

Why it matters to the business

NFS servers may experience memory exhaustion after several days of operation, resulting in degraded performance, service disruptions, or system crashes that require reboots.

How an attack unfolds

An attacker can trigger the memory leak by sending repeated RPC requests over TCP to an NFS server, causing the un-released page fragments to accumulate until memory is depleted.

How to fix it

Update the Linux kernel to a version containing commit 1ba1291172f935e6b6fe703161a948f3347400b8 or later stable releases that include the fix for the SUNRPC TCP memory leak.

How to confirm the fix worked

Verify the kernel version includes the fix commit; monitor memory usage on NFS servers under load to confirm no gradual increase unrelated to workload.

Typical attack path

1. Establish TCP connection to NFS server
2. Send multiple RPC requests to trigger response handling
3. Repeat to accumulate leaked memory pages
4. Monitor until target experiences memory exhaustion

How to detect it

Monitor system logs for out-of-memory events on NFS servers; check for unusual memory consumption patterns without corresponding workload increases.

What your security team should do

• Prioritize patching affected Linux kernel versions on NFS servers
• Monitor memory metrics for unexpected growth
• Consider rate limiting RPC connections if patching is delayed