CVE-2024-54456

What it actually does

Potential buffer overflow in nfs_sysfs_link_rpc_client() where a char[64] buffer receives an unknown-length string from clnt->cl_program->name via direct strcat(), allowing memory corruption.

Why it matters to the business

Systems running affected label-studio versions face elevated risk of crashes or remote code execution in NFS-related code paths, with urgency driven by 608 days since publication and listed threat actor activity despite low EPSS.

How an attack unfolds

An attacker supplies an oversized program name to the NFS client sysfs linkage routine, overflowing the fixed buffer; listed threat actors associated with CVE-2025-21702 Linux Kernel Privilege Escalation may chain this for escalation in environments with label-studio 1.7.1 or earlier.

How to fix it

Upgrade label-studio (PyPI) to version 1.7.2 or later; apply equivalent kernel patches replacing strcat() with strscpy() and strncat() in nfs_sysfs_link_rpc_client().

How to confirm the fix worked

Confirm label-studio version is 1.7.2 or newer via package manager; verify kernel source contains strscpy/strncat calls in the NFS sysfs function and recompile if building from source.

Typical attack path

1. Identify hosts exposing NFS sysfs interfaces or running vulnerable label-studio instances
2. Craft input that triggers nfs_sysfs_link_rpc_client() with a cl_program name exceeding remaining buffer space
3. Overwrite adjacent memory to achieve control-flow hijack or denial of service
4. Leverage resulting privileges for further persistence or lateral movement

How to detect it

Review system logs and process listings for unexpected crashes or privilege changes around NFS client initialization; correlate with any activity from actors linked to related kernel privilege-escalation CVEs.

What your security team should do

• Immediately upgrade all label-studio installations to 1.7.2
• Prioritize patching on internet-facing or high-value NFS clients given listed threat actor references
• Monitor EPSS trend and KEV status for any future elevation