CVE-2024-46682

What it actually does

Null pointer dereference of sc_file in nfs4_show_open for closed NFSv4.0 open stateids, triggered during states_show procfs reads after sc_status/sc_type split.

Why it matters to the business

Unexpected system crashes when administrators inspect NFS server state, causing availability loss on Linux systems running NFSv4 servers.

How an attack unfolds

An attacker with local or privileged access mounts an NFSv4.0 share, opens then closes a file, and reads the clients states proc entry to dereference the NULL pointer and panic the kernel.

How to fix it

Update the Linux kernel to include commit ba0b697de298285301c71c258598226e06494236; for KubeEdge deployments upgrade to versions 1.11.1, 1.10.2 or 1.9.4.

How to confirm the fix worked

Confirm the fix by reproducing the original steps (mount 4.0, close file, read states proc) without kernel panic; inspect kernel source or running version for the commit.

Typical attack path

1. Mount NFS share using version 4.0
2. Open and close a file on the share
3. Read /proc/fs/nfsd/clients/*/states with sufficient privileges
4. Trigger null dereference in nfs4_show_open leading to oops

How to detect it

Search kernel logs and dmesg for call traces containing nfs4_show_open and states_show in the nfsd module after NFSv4 activity.

• nfs4_show_open+0x78/0x2c0 [nfsd]
• states_show+0x44c/0x488 [nfsd]
• _raw_spin_lock+0xcc/0x160

What your security team should do

• Apply the referenced kernel commit or fixed release immediately on NFS servers
• Restrict read access to /proc/fs/nfsd/clients to privileged users only
• Monitor kernel logs for nfsd oops entries and schedule kernel updates