cbcvebase.
CVE-2024-26629
published 2024-03-13

CVE-2024-26629: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
9.7th percentile
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is documented in the kdoc comment for nfsd4_release_lockowner(), the test on so_count can transiently return a false positive resulting in a return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is clearly a protocol violation and with the Linux NFS client it can cause incorrect behaviour. If RELEASE_LOCKOWNER is sent while some other thread is still processing a LOCK request which failed because, at the time that request was received, the given owner held a conflicting lock, then the nfsd thread processing that LOCK request can hold a reference (conflock) to the lock owner that causes nfsd4_release_lockowner() to return an incorrect error. The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so it knows that the error is impossible. It assumes the lock owner was in fact released so it feels free to use the same lock owner identifier in some later locking request. When it does reuse a lock owner identifier for which a previous RELEASE failed, it will naturally use a lock_seqid of zero. However the server, which didn't release the lock owner, will expect a larger lock_seqid and so will respond with NFS4ERR_BAD_SEQID. So clearly it is harmful to allow a false positive, which testing so_count allows. The test is nonsense because ... well... it doesn't mean anything. so_count is the sum of three different counts. 1/ the set of states listed on so_stateids 2/ the set of active vfs locks owned by any of those states 3/ various transient counts such as for conflicting locks. When it is tested against '2' it is clear that one of these is the transient reference obtained by find_lockowner_str_locked(). It is not clear w

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 3097f38e91266c7132c3fdb7e778fac858c00670 < 99fb654d01dc3f08b5905c663ad6c89a9d83302f99fb654d01dc3f08b5905c663ad6c89a9d83302f
linuxlinux>= 4.14.282 < 4.154.15
linuxlinux>= 4.19.246 < 4.19.3064.19.306
linuxlinux>= 4.9.317 < 4.104.10
linuxlinux>= 5.10.120 < 5.10.2205.10.220
linuxlinux>= 5.15.45 < 5.15.1545.15.154
linuxlinux>= 5.17.13 < 5.185.18
linuxlinux>= 5.18.2 < 5.195.19
linuxlinux>= 5.4.197 < 5.55.5
linuxlinux>= ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b < e4cf8941664cae2f89f0189c29fe2ce8c6be0d03e4cf8941664cae2f89f0189c29fe2ce8c6be0d03
linuxlinux>= ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b < b7d2eee1f53899b53f069bba3a59a419fc3d331bb7d2eee1f53899b53f069bba3a59a419fc3d331b
linuxlinux>= ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b < 8f5b860de87039b007e84a28a5eefc888154e0988f5b860de87039b007e84a28a5eefc888154e098
linuxlinux>= ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b < edcf9725150e42beeca42d085149f4c88fa97afdedcf9725150e42beeca42d085149f4c88fa97afd
linuxlinux>= e2fc17fcc503cfca57b5d1dd3b646ca7eebead97 < c6f8b3fcc62725e4129f2c0fd550d022d4a7685ac6f8b3fcc62725e4129f2c0fd550d022d4a7685a
linuxlinux>= ef481b262bba4f454351eec43f024fec942c2d4c < 10d75984495f7fe62152c3b0dbfa3f0a6b739c9b10d75984495f7fe62152c3b0dbfa3f0a6b739c9b
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.221-15.10.221-1
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_ubuntu6.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.