CVE-2024-56740
kernel: nfs/localio: must clear res.replen in nfs_local_read_done
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 29, 2024
Updated · September 12, 2026
Description
A flaw was found in the Linux kernel's Network File System version 3 (NFSv3) LOCALIO component. This vulnerability occurs when NFSv3 LOCALIO is handling read operations and transitions back to standard Remote Procedure Call (RPC) usage, failing to properly clear a reply length buffer. This can lead to memory corruption, where incoming data is written to an incorrect memory location, potentially allowing a local attacker to cause a denial of service or gain unauthorized access.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 · Out-of-bounds Write