{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-54456","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-02-27T02:16:34.098Z","datePublished":"2025-02-27T02:18:08.143Z","dateUpdated":"2026-08-05T11:44:49.902Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:44:49.902Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()\n\nname is char[64] where the size of clnt->cl_program->name remains\nunknown. Invoking strcat() directly will also lead to potential buffer\noverflow. Change them to strscpy() and strncat() to fix potential\nissues."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is in the NFS *client* and is reached through local filesystem operations — a `mount -t nfs` or, without any privilege, ordinary path traversal that triggers `nfs_d_automount` on an already-mounted share. Although a malicious/compromised NFS server can drive the referral submount that reaches the function, the write itself is performed from local kernel-side data, so Local is the correct vector.\nAC:L - The code path is executed deterministically on every NFS mount and every crossmnt/referral submount, with no race, no timing window, and no memory-layout precondition outside the attacker's influence.\nPR:L - `nfs_clone_server()` → `nfs_sysfs_link_rpc_client()` is invoked from the `d_automount` dentry op on plain path traversal, so any unprivileged local user with access to an NFS mount (a very common configuration — autofs/NFS home directories) reaches the function with no capability check.\nUI:N - Automount-driven submounts happen automatically as a side effect of the attacker's own directory traversal; no separate victim action is required.\nS:U - Stack corruption in the NFS client stays within the kernel's own security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds write past a 64-byte kernel stack buffer overwrites adjacent frame state and, once leveraged into a control-flow or pointer primitive, permits disclosure of arbitrary kernel memory. Per kernel guidance, memory corruption that can be leveraged for info disclosure is scored High.\nI:H - Unbounded `strcpy`/`strcat` into a stack array is a classic out-of-bounds write reaching saved registers and the return address, which is directly exploitable for control-flow hijack and arbitrary kernel modification; OOB writes are scored High.\nA:H - Overwriting the saved return address or stack canary causes a stack-protector panic or an oops on return, crashing the kernel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/sysfs.c"],"versions":[{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","lessThan":"19b3ca651b4b473878c73539febe477905041442","status":"affected","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","lessThan":"dd8830779b77f4d1206d28d02ad56a03fc0e78f7","status":"affected","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","lessThan":"e8e0eb5601d4a6c74c336e3710afe3a0348c469d","status":"affected","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","lessThan":"49fd4e34751e90e6df009b70cd0659dc839e7ca8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/sysfs.c"],"versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.79","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.16","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.4","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.12.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.13.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/19b3ca651b4b473878c73539febe477905041442"},{"url":"https://git.kernel.org/stable/c/dd8830779b77f4d1206d28d02ad56a03fc0e78f7"},{"url":"https://git.kernel.org/stable/c/e8e0eb5601d4a6c74c336e3710afe3a0348c469d"},{"url":"https://git.kernel.org/stable/c/49fd4e34751e90e6df009b70cd0659dc839e7ca8"}],"title":"NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()","x_generator":{"engine":"bippy-1.2.0"}}}}