{"id":"CVE-2024-54456","state":"PUBLISHED","title":"NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()\n\nname is char[64] where the size of clnt->cl_program->name remains\nunknown. Invoking strcat() directly will also lead to potential buffer\noverflow. Change them to strscpy() and strncat() to fix potential\nissues.","publishedAt":"2025-02-27T02:18:08.143Z","updatedAt":"2026-08-05T11:44:49.902Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"19b3ca651b4b473878c73539febe477905041442","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"dd8830779b77f4d1206d28d02ad56a03fc0e78f7","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"e8e0eb5601d4a6c74c336e3710afe3a0348c469d","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"49fd4e34751e90e6df009b70cd0659dc839e7ca8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/sysfs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.79","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.16","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.4","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/sysfs.c"]}],"references":["https://git.kernel.org/stable/c/19b3ca651b4b473878c73539febe477905041442","https://git.kernel.org/stable/c/dd8830779b77f4d1206d28d02ad56a03fc0e78f7","https://git.kernel.org/stable/c/e8e0eb5601d4a6c74c336e3710afe3a0348c469d","https://git.kernel.org/stable/c/49fd4e34751e90e6df009b70cd0659dc839e7ca8"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/54xxx/CVE-2024-54456.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-54456","state":"PUBLISHED","datePublished":"2025-02-27T02:18:08.143Z","dateUpdated":"2026-08-05T11:44:49.902Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-02-27T02:16:34.098Z"},"containers":{"cna":{"title":"NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()\n\nname is char[64] where the size of clnt->cl_program->name remains\nunknown. Invoking strcat() directly will also lead to potential buffer\noverflow. Change them to strscpy() and strncat() to fix potential\nissues."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"19b3ca651b4b473878c73539febe477905041442","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"dd8830779b77f4d1206d28d02ad56a03fc0e78f7","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"e8e0eb5601d4a6c74c336e3710afe3a0348c469d","versionType":"git"},{"version":"e13b549319a684dd80c4cc25e9567a5c84007e32","status":"affected","lessThan":"49fd4e34751e90e6df009b70cd0659dc839e7ca8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/sysfs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.5","versionType":"semver"},{"version":"6.6.79","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.16","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.4","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfs/sysfs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/19b3ca651b4b473878c73539febe477905041442"},{"url":"https://git.kernel.org/stable/c/dd8830779b77f4d1206d28d02ad56a03fc0e78f7"},{"url":"https://git.kernel.org/stable/c/e8e0eb5601d4a6c74c336e3710afe3a0348c469d"},{"url":"https://git.kernel.org/stable/c/49fd4e34751e90e6df009b70cd0659dc839e7ca8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is in the NFS *client* and is reached through local filesystem operations — a `mount -t nfs` or, without any privilege, ordinary path traversal that triggers `nfs_d_automount` on an already-mounted share. Although a malicious/compromised NFS server can drive the referral submount that reaches the function, the write itself is performed from local kernel-side data, so Local is the correct vector.\nAC:L - The code path is executed deterministically on every NFS mount and every crossmnt/referral submount, with no race, no timing window, and no memory-layout precondition outside the attacker's influence.\nPR:L - `nfs_clone_server()` → `nfs_sysfs_link_rpc_client()` is invoked from the `d_automount` dentry op on plain path traversal, so any unprivileged local user with access to an NFS mount (a very common configuration — autofs/NFS home directories) reaches the function with no capability check.\nUI:N - Automount-driven submounts happen automatically as a side effect of the attacker's own directory traversal; no separate victim action is required.\nS:U - Stack corruption in the NFS client stays within the kernel's own security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds write past a 64-byte kernel stack buffer overwrites adjacent frame state and, once leveraged into a control-flow or pointer primitive, permits disclosure of arbitrary kernel memory. Per kernel guidance, memory corruption that can be leveraged for info disclosure is scored High.\nI:H - Unbounded `strcpy`/`strcat` into a stack array is a classic out-of-bounds write reaching saved registers and the return address, which is directly exploitable for control-flow hijack and arbitrary kernel modification; OOB writes are scored High.\nA:H - Overwriting the saved return address or stack canary causes a stack-protector panic or an oops on return, crashing the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:44:49.902Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.6.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.12.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.13.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}