NFSv4: NULL pointer dereference in pnfs_mark_matching_lsegs_return()
Summary
GSD-2021-1000667: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return(). Affects Kernel versions >= 9ffa7967f9379a0a1b924e9ffeda709d72237da7, < 39785761feadf261bc5101372b0b0bbaf6a94494. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware and software components. The NFSv4 (Network File System version 4) is a protocol implemented in the Kernel package that allows remote file access over a network. It is widely used for sharing files between systems. However, a vulnerability has been discovered in the pnfs_mark_matching_lsegs_return() function of the NFSv4 implementation.
Vulnerability Detail
The vulnerability in pnfs_mark_matching_lsegs_return() function of NFSv4 can lead to a NULL pointer dereference. This means that the function attempts to access or manipulate data using a null pointer, which can cause the system to crash or behave unexpectedly. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial of service. The vulnerability was introduced in Linux Kernel version v4.19.191 and is fixed in version v4.19.193.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Kernel package to the fixed version.
Conclusion
The NULL pointer dereference vulnerability in pnfs_mark_matching_lsegs_return() function of NFSv4 can have serious consequences, including system crashes and potential remote code execution. It is crucial to update the Linux Kernel package to version v4.19.193 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or unexpected behavior, and it may also be exploited by attackers to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time.
Yes, a fix is available in Linux Kernel version v4.19.193. It is recommended to update to this version or a later one.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
