CVE-2024-46697

What it actually does

Uninitialized stack variable in nfsd4_encode_fattr4 can be passed to a free operation on an early goto path, resulting in memory corruption within the NFS server subsystem.

Why it matters to the business

Organizations running NFS servers face risk of kernel instability or crashes that disrupt file-sharing services; low exploit probability and absence from known campaigns reduce immediate urgency but still require patching to maintain service availability.

How an attack unfolds

An attacker sends a crafted NFSv4 request that causes nfsd4_encode_fattr4 to take an early error path before the security label check, leaving the context pointer uninitialized so that a subsequent free call operates on arbitrary stack data.

How to fix it

Apply the kernel patch that initializes nfsd4_fattr_args.context early (commit dd65b324174a64558a16ebbf4c3266e5701185d0) and rebuild or upgrade to a kernel containing this fix.

How to confirm the fix worked

Confirm the presence of the initialization change in the nfsd4_fattr_args structure and verify that nfsd4_encode_fattr4 no longer reaches the free path with uninitialized context.

Typical attack path

1. Establish NFSv4 connection to target server
2. Send malformed fattr4 encoding request that triggers early goto
3. Trigger free of uninitialized stack value
4. Cause kernel memory corruption or panic

How to detect it

Inspect kernel logs for nfsd-related oops or panic messages referencing fattr_args or security label handling; correlate with unusual NFSv4 traffic patterns.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems exposing nfsd
• Review NFS server configurations to limit exposure where possible until patched
• Monitor for kernel oops or panic events related to nfsd