CVE-2024-54456

CVE-2024-54456 is a potential buffer overflow vulnerability in the Linux kernel's NFS implementation, specifically within the nfs_sysfs_link_rpc_client() function. The issue arises because a fixed-size char[64] buffer named 'name' is populated using strcat(), where the size of the input string clnt->cl_program->name is unknown, leading to possible overflow. This has been classified under CWE-787 (Out-of-bounds Write) with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability without user interaction. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes due to the buffer overflow.

Mitigation involves applying the relevant Linux kernel patches, as detailed in the stable commit references. These commits replace the unsafe strcat() calls with strscpy() and strncat() to ensure bounds-safe string operations and prevent overflows. Security practitioners should update affected kernel versions accordingly.