CVE-2024-47733

What it actually does

The netfs module creates procfs dentries under 'fs/netfs' during initialization but calls remove_proc_entry instead of remove_proc_subtree on exit, leaving child entries such as 'requests' and triggering a kernel WARNING in remove_proc_entry.

Why it matters to the business

Systems with 455 downstream dependents may experience kernel log spam and warnings during module unload, increasing operational noise and complicating troubleshooting in large Linux deployments; no immediate ransomware or remote exploitation risk exists.

How an attack unfolds

An attacker with local access loads the netfs module and then unloads it via rmmod, triggering the non-empty directory warning; no remote code execution or privilege escalation path is known, and listed threat actors have not been observed using this specific issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 603f95cefbee06a31b03137b777f03e3c2163d72 or later; replace remove_proc_entry with remove_proc_subtree in netfs_exit; apply vendor updates for affected distributions such as the fixed redis package on Rocky Linux 8.

How to confirm the fix worked

After patching, load and unload the netfs module and confirm absence of the 'removing non-empty directory' WARNING in dmesg or kernel logs; verify the procfs subtree under /proc/fs/netfs is fully removed on module exit.

Typical attack path

1. Obtain local shell or sufficient privileges to load/unload kernel modules
2. Ensure netfs module is loaded (modprobe netfs)
3. Execute rmmod netfs to trigger exit path
4. Observe WARNING in kernel logs about leaking procfs subtree

How to detect it

Search kernel logs and dmesg for the exact string 'remove_proc_entry: removing non-empty directory' combined with 'fs/netfs' and the rmmod process; correlate with module load/unload events in audit logs.

• remove_proc_entry: removing non-empty directory 'fs/netfs'
• leaking at least 'requests'
• netfs_exit+0x12/0x620 [netfs]
• rmmod.*netfs

What your security team should do

• Prioritize kernel updates on all systems exposing the netfs module within the next maintenance window
• Monitor kernel logs for the specific remove_proc_entry warning as a temporary detection measure
• Review module unload scripts and automated tests that exercise netfs to prevent repeated warnings