CVE-2024-47692 is a vulnerability identified in the Linux kernel's NFS daemon (nfsd) component, specifically related to the handling of client reclaim operations in the NFSv4 protocol. The issue arises when the nfsdcld daemon encounters a corrupted main.sqlite database file located at /var/lib/nfs/nfsdcld/. This corruption can cause the variable namelen, which represents the length of a client name, to be zero. When namelen is zero, the kernel function memdup_user() returns a special pointer value ZERO_SIZE_PTR instead of a valid memory address. Subsequently, the code attempts to access name.data using this ZERO_SIZE_PTR in the function nfs4_client_to_reclaim(), leading to a null pointer dereference. This triggers a kernel crash detected by Kernel Address Sanitizer (KASAN), as evidenced by the detailed kernel stack trace provided. The root cause is the lack of validation for namelen being zero before dereferencing the pointer. The fix involves adding a check to return an error (-EINVAL) when namelen is zero, preventing the null pointer dereference. This vulnerability affects Linux kernel versions including 5.10.0 and potentially others that incorporate the vulnerable nfsd code. The vulnerability does not require user interaction but does require the presence of a corrupted nfsdcld database and the use of NFSv4 client reclaim functionality. No known exploits are currently reported in the wild. The vulnerability is a denial-of-service (DoS) type, as it causes a kernel crash, potentially leading to system instability or downtime on affected servers running NFS services.

For European organizations, this vulnerability poses a risk primarily to servers running Linux with NFSv4 services enabled, especially those using nfsdcld for client tracking. The impact is a potential denial-of-service condition caused by a kernel crash triggered by malformed or corrupted client state data. This could disrupt file sharing services critical to business operations, particularly in sectors relying heavily on NFS for storage and data access, such as telecommunications, finance, research institutions, and cloud service providers. The vulnerability could be exploited inadvertently by corrupted state files or potentially by an attacker with access to the NFS server or its client state files, leading to service outages. Given the kernel-level nature of the crash, recovery might require system reboots, causing downtime. Confidentiality and integrity are not directly impacted, but availability is significantly affected. Organizations with high availability requirements and those operating critical infrastructure could face operational disruptions and potential financial losses due to service interruptions.

To mitigate this vulnerability, European organizations should: 1) Apply the latest Linux kernel patches that include the fix for CVE-2024-47692 as soon as they become available. 2) Regularly monitor and verify the integrity of the /var/lib/nfs/nfsdcld/main.sqlite database to detect corruption early. Implement automated integrity checks and alerts. 3) Restrict access to the NFS server and its client state files to trusted administrators only, minimizing the risk of malicious corruption. 4) Implement robust backup and recovery procedures for NFS server state data to enable quick restoration in case of corruption. 5) Consider deploying kernel hardening and runtime protection tools such as KASAN or other memory safety mechanisms in testing environments to detect similar issues proactively. 6) Monitor system logs for signs of nfsdcld crashes or kernel panics related to NFS client reclaim operations to detect exploitation attempts or accidental triggers. 7) Where feasible, isolate critical NFS servers in segmented network zones to limit exposure. 8) Educate system administrators on the importance of maintaining healthy NFS client state databases and on procedures to safely recover from corruption.