CVE-2024-46690

What it actually does

The nfsd4_deleg_getattr_conflict function dereferences fl->c.flc_owner without verifying that fl->fl_lmops matches the expected nfsd_lease_mng_ops, allowing invalid memory access when a third-party lease manager is present and leading to memory corruption.

Why it matters to the business

NFS servers on affected Linux kernels risk crashes or instability during file delegation operations involving external leases, disrupting file-sharing services; downstream Go packages using the listed middleware may inherit exposure through kernel dependencies.

How an attack unfolds

An attacker configures an NFSv4 server to grant delegations then introduces a conflicting third-party lease; the unsafe owner dereference is triggered during getattr conflict handling, resulting in kernel memory corruption that can be leveraged for denial of service or further exploitation.

How to fix it

Upgrade the Linux kernel to commit 1b46a871e980e3daa16fd5e77539966492e8910a or later stable releases; for affected Cosmos IBC packet-forward-middleware packages update to v4.1.1, v5.2.1 or v6.1.1 respectively.

How to confirm the fix worked

Verify running kernel contains commit 1b46a871e980e3daa16fd5e77539966492e8910a via git log or package version; confirm middleware packages report the listed fixed versions; exercise NFS delegation and third-party lease scenarios to ensure no kernel faults occur.

Typical attack path

1. Establish NFSv4 mount with delegation support enabled
2. Obtain or create a third-party lease on the same file
3. Issue getattr operations that invoke nfsd4_deleg_getattr_conflict
4. Trigger dereference of non-nfsd flc_owner pointer
5. Exploit resulting memory corruption for crash or code execution

How to detect it

Search kernel logs and dmesg for oops, BUG, or panic entries mentioning nfsd4_deleg_getattr_conflict or flc_owner dereference; inspect auditd or syscall traces for unusual NFS lease and delegation activity preceding crashes.

What your security team should do

• Apply kernel and middleware updates immediately on all NFS-serving systems
• Audit environments for active NFSv4 delegation usage and prioritize those hosts
• Monitor kernel logs for oops or panic messages referencing nfsd lease handling
• Disable NFSv4 delegations temporarily if patching is delayed