Vulnerability in nfsd: NULL dereference in nfs3svc_encode_getaclres
Summary
UVI-2021-1001178: nfsd: fix NULL dereference in nfs3svc_encode_getaclres. Affects Kernel versions >= 20798dfe249a01ad1b12eec7dbc572db5003244a, < 650e6f383a6eb40f7c0a010982a74ab4b6893870. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nfsd package is a component of the Linux Kernel that provides support for the Network File System (NFS) server. NFS allows remote clients to access files and directories over a network. The nfsd package is responsible for handling NFS requests and providing the necessary responses. It is an integral part of the Linux Kernel and is widely used in various Linux distributions.
Vulnerability Detail
The vulnerability identified as UVI-2021-1001178 is a NULL dereference issue in the nfsd package. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition. By sending a specially crafted request to the NFS server, an attacker can trigger a NULL pointer dereference, leading to a kernel crash. This vulnerability has the potential to disrupt the availability of the affected system and may require a system reboot to recover.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in the nfsd package, identified as UVI-2021-1001178, can lead to a denial-of-service condition by triggering a NULL pointer dereference. To mitigate this vulnerability, users should update their Linux Kernel to version v5.13.4 or later. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition, leading to a kernel crash and potential system unavailability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate any potential risks.
Yes, this vulnerability can be remotely exploited by sending a specially crafted request to the NFS server.
Unfortunately, there are no known mitigations available for this vulnerability. It is recommended to apply the fix as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
