NFSv4: NULL pointer dereference in pnfs_mark_matching_lsegs_return()
Summary
GSD-2021-1000697: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return(). Affects Kernel versions >= 80e34f4957ec3010c85f9bb0b568a8d46acdf535, < 4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system. It provides the core functionality and interfaces for the system's hardware, software, and user applications. The NFSv4 (Network File System version 4) is a protocol within the Kernel package that allows remote file access and sharing over a network. It is widely used for distributed file systems. This vulnerability specifically affects the pnfs_mark_matching_lsegs_return() function in the NFSv4 implementation.
Vulnerability Detail
The vulnerability in pnfs_mark_matching_lsegs_return() function of NFSv4 allows for a NULL pointer dereference. This means that under certain conditions, the function may attempt to access memory using a NULL pointer, leading to a crash or potential code execution. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) attack or execute arbitrary code with elevated privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the NFSv4 vulnerability in the pnfs_mark_matching_lsegs_return() function of the Kernel package could potentially lead to a system crash or code execution. It is crucial to update the Linux Kernel package to version v4.9.271 or later to mitigate this vulnerability. Regularly applying security patches and updates is essential for maintaining a secure system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a system crash (DoS) to potential code execution with elevated privileges.
An attacker could potentially exploit this vulnerability by crafting a malicious request that triggers the NULL pointer dereference, leading to a crash or potential code execution.
There is no evidence of this vulnerability being actively exploited at the moment. However, it is important to apply the recommended fix to mitigate any potential risks.
No, this vulnerability was introduced in version v4.9.269 by commit 80e34f4957ec3010c85f9bb0b568a8d46acdf535 and fixed in version v4.9.271 by commit 4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42. It is recommended to update to the fixed version to ensure the vulnerability is addressed.
You can find more information about this vulnerability in the GSD-2021-1000697 entry of the GSD database maintained by the Cloud Security Alliance. The source link is provided in the database_specific section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
