Log in Start free

Vulnerability · Published Aug 17, 2024 · Assigned by Linux

CVE-2024-43826nfs: pass explicit offset/count to trace events

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: nfs: pass explicit offset/count to trace events nfs_folio_length is unsafe to use without having the folio locked and a check for a NULL ->f_mapping that protects against truncations and can lead to kernel crashes. E.g. when running xfstests generic/065 with all nfs trace points enabled. Follow the model of the XFS trace points and pass in an explіcit offset and length. This has the additional benefit that these values can be more accurate as some of the users touch partial folio ranges.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.10.3-1DEBIAN-CVE-2024-43826
Debian:14linux6.10.3-1DEBIAN-CVE-2024-43826
Ubuntu:24.04:LTSlinux6.8.0-50.51UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-aws6.8.0-1020.22UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1020.22~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-azure6.8.0-1020.23UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1020.23~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-gcp6.8.0-1019.21UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1019.21~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-gke6.8.0-1015.19UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1002.4UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-50.51~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-ibm6.8.0-1017.17UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-50.51.1UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-50.51.1~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1019.21UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1019.21~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1019.21.1UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1018.18UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-oracle6.8.0-1017.18UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1017.18~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-raspi6.8.0-1016.18UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-43826
Ubuntu:24.04:LTSlinux-riscv6.8.0-50.51.1UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-50.51.1~22.04.1UBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-43826
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-43826

Affected products (as reported)

VendorProductVersions
Linux Linux eb5654b3b89d5e836312cea9f3fdb49457852e89 – before 1562138b9cababf637eee485e98491f9206a990deb5654b3b89d5e836312cea9f3fdb49457852e89 – before 387e6e9d110250946df4d4ebef9c2def5c7a4722eb5654b3b89d5e836312cea9f3fdb49457852e89 – before fada32ed6dbc748f447c8d050a961b75d946055a
Linux Linux 6.3

References