CVE-2024-57927
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
19/01/2025
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
nfs: Fix oops in nfs_netfs_init_request() when copying to cache<br />
<br />
When netfslib wants to copy some data that has just been read on behalf of<br />
nfs, it creates a new write request and calls nfs_netfs_init_request() to<br />
initialise it, but with a NULL file pointer. This causes<br />
nfs_file_open_context() to oops - however, we don&#39;t actually need the nfs<br />
context as we&#39;re only going to write to the cache.<br />
<br />
Fix this by just returning if we aren&#39;t given a file pointer and emit a<br />
warning if the request was for something other than copy-to-cache.<br />
<br />
Further, fix nfs_netfs_free_request() so that it doesn&#39;t try to free the<br />
context if the pointer is NULL.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.12 (including) | 6.12.10 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



