CVE-2024-57924

What it actually does

The flaw triggers WARN_ON assertions in kernel paths using exportfs_encode_fh when encode_fh fails for filesystems such as overlayfs, allowing local conditions to cause kernel warnings or instability.

Why it matters to the business

Systems may experience unexpected crashes or degraded availability during routine file operations, increasing operational risk and potential downtime especially on older kernels still in use across many environments.

How an attack unfolds

A local attacker with low privileges triggers the condition by performing file handle operations involving overlayfs mounts with specific options, inotify watches, and cache drops, causing the erroneous assertion to fire and leading to denial of service.

How to fix it

Update affected kernels to versions containing the fix that relaxes the assertions; for listed Red Hat packages apply the exact fixed versions such as ntp 0:4.2.6p5-10.el6.1 on EL6 and 0:4.2.6p5-22.el7_2.2 on EL7.

How to confirm the fix worked

Confirm kernel version or package versions match the fixed releases, then reproduce the overlayfs/inotify/drop_caches scenario and verify no WARN_ON is emitted.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Mount overlayfs with index=on and nfs_export=on
3. Set up inotify watches on relevant paths
4. Trigger drop_caches to force encode_fh failure
5. Observe kernel assertion and resulting instability

How to detect it

Search kernel logs for WARN_ON messages related to encode_fh or exportfs failures, especially around overlayfs and inotify activity; correlate with cache drop events.

What your security team should do

• Prioritize patching systems with the listed NTP and kernel packages to the provided fixed versions
• Monitor for any local DoS attempts involving filesystem encoding paths
• Review overlayfs configurations for unnecessary nfs_export=on usage