CVE-2024-36958
CVE-2024-36958 is a medium-severity vulnerability in Netapp Converged Systems Advisor Agent with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 5.5)
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-36308
- Affected product: Netapp Converged Systems Advisor Agent
- Published:
- Last modified:
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
Frequently asked questions
- What is CVE-2024-36958?
- In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
- How severe is CVE-2024-36958?
- CVE-2024-36958 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2024-36958 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-36958?
- CVE-2024-36958 primarily affects Netapp Converged Systems Advisor Agent. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2024-36958?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-36958 have an EU (EUVD) identifier?
- Yes. CVE-2024-36958 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-36308.
- When was CVE-2024-36958 published?
- CVE-2024-36958 was published on 2024-05-30 and last updated on 2026-06-17.
References
- https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7
- https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc
- https://security.netapp.com/advisory/ntap-20250404-0007/
Affected products (16)
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
- cpe:2.3:a:netapp:converged_systems_advisor_agent:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
More vulnerabilities in Netapp Converged Systems Advisor Agent
- CVE-2019-10160 — Critical (CVSS 9.8): A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3…
- CVE-2023-0361 — High (CVSS 7.4): A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can…
- CVE-2022-48566 — Medium (CVSS 5.9): An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations…