CVE-2024-54456

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potential buffer overflow. Change them to strscpy() and strncat() to fix potential issues.

This vulnerability is evaluated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local system privileges to initiate NFS mounts or configure RPC clients, limiting exposure to authenticated scenarios. In default configurations, standard RPC program names defined by the kernel are well within fixed buffer limits, which substantially restricts practical attack opportunities. A successful exploit would primarily trigger a kernel crash, resulting in a denial of service rather than immediate privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.