CVE-2024-46695

What it actually does

The flaw bypasses LSM permission checks in the inode_setsecctx hook by calling __vfs_setxattr_noperm instead of __vfs_setxattr_locked inside nfsd_setattr, allowing unauthorized modification of security labels on NFS filesystems with root squashing.

Why it matters to the business

Root users on NFS clients can alter file security contexts on exported shares, weakening mandatory access controls and increasing the chance of unauthorized data access or privilege escalation in SELinux/Smack-protected environments.

How an attack unfolds

An attacker obtains root on an NFS client, mounts a root-squashed share, and issues setattr operations targeting security xattrs; nfsd performs only partial checks via fh_verify and nfsd_permission, skipping the full security_inode_setxattr validation that the LSM hook expects.

How to fix it

Upgrade the Linux kernel to a version containing commit 2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda, which replaces the __vfs_setxattr_noperm call with __vfs_setxattr_locked in nfsd_setattr; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda or later; test by attempting a security label change as root on a client and verifying that the server now enforces LSM checks and recalls conflicting delegations.

Typical attack path

1. Obtain root privileges on an NFS client system
2. Mount the target NFS share exported with root squashing
3. Invoke setxattr, chcon, or equivalent to change file security labels
4. Bypass occurs because nfsd_setattr skips full LSM permission checks
5. Modified labels persist on the server, affecting subsequent access decisions

How to detect it

Review kernel and NFS server logs for setattr calls on security contexts that bypass normal LSM hooks; look for unexpected security xattr modifications on NFS-exported files and correlate with client root activity.

• nfsd_setattr
• security_inode_setsecctx
• __vfs_setxattr_noperm

What your security team should do

• Apply the kernel fix to all NFS servers using SELinux or Smack
• Verify root squashing remains enabled on all NFS exports
• Audit NFS client root accounts and limit their use
• Enable logging of setattr operations involving security xattrs
• Re-test NFS workflows after patching to ensure delegation recall functions correctly