NFSv4: NULL pointer dereference in pnfs_mark_matching_lsegs_return()
Summary
GSD-2021-1000572: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return(). Affects Kernel versions >= 7e65ea887d0c0997f3053acd91a027af45e71c5b, < b090d110e66636bca473fd8b98d5c97b555a965a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and processes. The NFSv4 (Network File System version 4) is a protocol implemented in the Kernel package that allows remote file access over a network. It provides improved performance, security, and scalability compared to previous versions of NFS. However, a vulnerability has been discovered in the pnfs_mark_matching_lsegs_return() function of NFSv4, which can lead to a NULL pointer dereference.
Vulnerability Detail
The vulnerability in pnfs_mark_matching_lsegs_return() function of NFSv4 occurs when a NULL pointer is dereferenced, resulting in a system crash or potential privilege escalation. An attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable system, causing the function to dereference a NULL pointer. This could lead to a denial of service (system crash) or potentially allow the attacker to execute arbitrary code with elevated privileges. The vulnerability was introduced in version v5.12.3 of the Linux Kernel and has been fixed in version v5.12.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update the Kernel package to the fixed version.
Conclusion
The vulnerability in pnfs_mark_matching_lsegs_return() function of NFSv4 can lead to a system crash or potential privilege escalation. It is crucial to update the Linux Kernel package to version v5.12.9 or later to fix this vulnerability. Applying the official patch or updating the Kernel package will ensure the system's security and stability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash (denial of service) or potential privilege escalation, allowing an attacker to execute arbitrary code with elevated privileges.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always important to apply security patches promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to a vulnerable system.
Yes, this vulnerability has been fixed in version v5.12.9 of the Linux Kernel. It is recommended to update to this version or later to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
