CVE-2024-35882: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35882 is a memory leak vulnerability discovered in the Linux kernel's SUNRPC (Sun Remote Procedure Call) implementation when handling RPC-over-TCP connections. The vulnerability was discovered when small NFS servers were reported to suffer from memory exhaustion after just a few days of operation. The issue affects Linux kernel versions from 6.7 up to (excluding) 6.8.5, and versions from 6.6 up to (excluding) 6.6.26 (NVD).

The vulnerability stems from a flaw introduced by commit e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call"). The commit incorrectly assumed that sock_sendmsg() releases all pages in the underlying bio_vec array. However, while svc_xprt_release() releases the request's response pages, the record marker page fragment remains unreleased, leading to a gradual memory leak. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

The primary impact of this vulnerability is a slow but steady memory leak in NFS servers using RPC-over-TCP connections. Over time, this leads to memory exhaustion on affected systems, potentially causing service degradation or system instability (Kernel Patch).

The vulnerability requires local access with privileged permissions to exploit. It primarily affects systems running NFS servers with RPC-over-TCP connections enabled (NVD).

A fix has been developed and committed to the Linux kernel. The solution involves properly freeing the page fragment using page_frag_free(buf) after the sock_sendmsg() call. System administrators should update to kernel versions 6.8.5 or later, or 6.6.26 or later, depending on their kernel series (Kernel Patch).