CVE-2024-49974

5.5 · MEDIUM

Published Oct 21, 2024 linux EPSS 0.27% (19th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-49974 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 21, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Limit the number of concurrent async COPY operations

Nothing appears to limit the number of concurrent async COPY

operations that clients can start. In addition, AFAICT each async

COPY can copy an unlimited number of 4MB chunks, so can run for a

long time. Thus IMO async COPY can become a DoS vector.

Add a restriction mechanism that bounds the number of concurrent

background COPY operations. Start simple and try to be fair -- this

patch implements a per-namespace limit.

An async COPY request that occurs while this limit is exceeded gets

NFS4ERR_DELAY. The requesting client can choose to send the request

again after a delay or fall back to a traditional read/write style

copy.

If there is need to make the mechanism more sophisticated, we can

visit that in future patches.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 0, < 6.10.14	Affected

References

Ref git.kernel.org/stable/c/43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf Ref git.kernel.org/stable/c/6a488ad7745b8f64625c6d3a24ce7e448e83f11b Ref git.kernel.org/stable/c/7ea9260874b779637aff6d24c344b8ef4ac862a0 Ref git.kernel.org/stable/c/9e52ff544e0bfa09ee339fd7b0937ee3c080c24e Ref git.kernel.org/stable/c/aadc3bbea163b6caaaebfdd2b6c4667fbc726752 Ref git.kernel.org/stable/c/ae267989b7b7933dfedcd26468d0a88fc3a9da9e Ref git.kernel.org/stable/c/b4e21431a0db4854b5023cd5af001be557e6c3db Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-49974?

CVE-2024-49974 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 21, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-49974?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-49974?

How can CyberStrike help with CVE-2024-49974?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-49974 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719