{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35914","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.122Z","datePublished":"2024-05-19T08:35:07.367Z","dateUpdated":"2026-08-05T11:30:56.369Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:30:56.369Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix error cleanup path in nfsd_rename()\n\nCommit a8b0026847b8 (\"rename(): avoid a deadlock in the case of parents\nhaving no common ancestor\") added an error bail out path. However this\npath does not drop the remount protection that has been acquired. Fix\nthe cleanup path to properly drop the remount protection."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached purely by sending an NFSv2/v3 RENAME RPC or an NFSv4 COMPOUND containing RENAME over TCP/2049. No local access to the server is needed.\nAC:L - The remote client supplies both directory filehandles itself and can retry the request an unbounded number of times; nfsd explicitly tolerates DCACHE_DISCONNECTED directory dentries (it only warns), so the lock_rename() -EXDEV bail-out is reachable from client-controlled input rather than depending on a condition the attacker cannot influence.\nPR:N - With the standard AUTH_SYS/AUTH_UNIX export configuration nfsd performs no cryptographic authentication — the client asserts its own uid/gid, so the fh_verify() NFSD_MAY_REMOVE/NFSD_MAY_CREATE checks are satisfied by a self-declared identity. Any host permitted by the export list can trigger it with no privileges on the server.\nUI:N - The attacking NFS client drives the entire sequence itself by issuing RENAME requests; no administrator or user action on the server is required.\nS:U - The leaked mnt_want_write()/sb_start_write() reference affects only the exported filesystem within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an unbalanced mount write-access/freeze-protection reference on an error path; no memory is read out of bounds, no kernel pointer or file content is exposed, and the rename itself never executes.\nI:N - Nothing is written or modified — the operation fails with NFS3ERR_XDEV/NFSERR_ACCES and returns; there is no memory corruption or arbitrary-write primitive of any kind.\nA:H - The error path returns while still holding the export's remount/freeze protection, and a remote client can drive it repeatedly across concurrent connections to keep write references pinned on the exported filesystem, indefinitely stalling fsfreeze and remount-read-only (snapshot/backup) operations on that mount."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/vfs.c"],"versions":[{"version":"a8b0026847b8c43445c921ad2c85521c92eb175f","lessThan":"331e125e02c08ffaecc1074af78a988a278039bd","status":"affected","versionType":"git"},{"version":"a8b0026847b8c43445c921ad2c85521c92eb175f","lessThan":"9fe6e9e7b58944037714442384075c17cfde1c56","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/vfs.c"],"versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","status":"unaffected","versionType":"semver"},{"version":"6.8.5","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.8.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd"},{"url":"https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56"}],"title":"nfsd: Fix error cleanup path in nfsd_rename()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-18T16:53:51.345113Z","id":"CVE-2024-35914","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-18T16:54:02.746Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:21:48.929Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/331e125e02c08ffaecc1074af78a988a278039bd","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9fe6e9e7b58944037714442384075c17cfde1c56","tags":["x_transferred"]}]}]}}