Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-57924— fs: relax assertions on failure to encode file handles

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于exportfs_encode_fh函数在编码文件句柄失败时，存在不必要的警告。

AI Predicted 4.3 Difficulty: Moderate EPSS 0.27% · P19

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux be77196b809cdce8603a5aadd5e3cfabd3cbef96< 73697928c806fe4689939722184a86fc1c1957b4 affected
be77196b809cdce8603a5aadd5e3cfabd3cbef96< f47c834a9131ae64bee3c462f4e610c67b0a000f affected
be77196b809cdce8603a5aadd5e3cfabd3cbef96< adcde2872f8fc399b249758ae1990dcd53b694ea affected
be77196b809cdce8603a5aadd5e3cfabd3cbef96< 974e3fe0ac61de85015bbe5a4990cf4127b304b2 affected
3.8 affected
< 3.8 unaffected
6.1.151≤ 6.1.* unaffected
6.6.74≤ 6.6.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-57924

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fs: relax assertions on failure to encode file handles
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 ("ovl: support encoding non-decodable file handles") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于exportfs_encode_fh函数在编码文件句柄失败时，存在不必要的警告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux be77196b809cdce8603a5aadd5e3cfabd3cbef96 ~ 73697928c806fe4689939722184a86fc1c1957b4 -
Linux Linux 3.8 -

II. Public POCs for CVE-2024-57924

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-57924

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-57924 (3)

Same Patch Batch · Linux · 2025-01-19 · 47 CVEs total

CVE-2024-57929 7.8 HIGH dm array: fix releasing a faulty array block twice in dm_array_cursor_end
CVE-2025-21652 7.8 HIGH ipvlan: Fix use-after-free in ipvlan_get_iflink().
CVE-2024-57918 7.8 HIGH drm/amd/display: fix page fault due to max surface definition mismatch
CVE-2024-57921 7.8 HIGH drm/amdgpu: Add a lock when accessing the buddy trim function
CVE-2025-21631 7.8 HIGH block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
CVE-2024-57926 7.8 HIGH drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
CVE-2025-21646 7.5 HIGH afs: Fix the maximum cell name length
CVE-2025-21647 7.3 HIGH sched: sch_cake: add bounds checks to host bulk flow fairness counts
CVE-2025-21638 7.1 HIGH sctp: sysctl: auth_enable: avoid using current->nsproxy
CVE-2025-21637 7.1 HIGH sctp: sysctl: udp_port: avoid using current->nsproxy
CVE-2025-21640 7.1 HIGH sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
CVE-2025-21650 7.1 HIGH net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
CVE-2024-57911 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
CVE-2024-57910 iio: light: vcnl4035: fix information leak in triggered buffer
CVE-2024-57912 iio: pressure: zpa2326: fix information leak in triggered buffer
CVE-2024-57904 iio: adc: at91: call input_free_device() on allocated iio_dev
CVE-2024-57908 iio: imu: kmx61: fix information leak in triggered buffer
CVE-2024-57913 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
CVE-2024-57914 usb: typec: tcpci: fix NULL pointer issue on shared irq case
CVE-2024-57928 netfs: Fix enomem handling in buffered reads

Showing top 20 of 47 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-57924

No comments yet

Leave a comment