CVE-2021-3178 — Path Traversal in Linux

CWE-22 — Path Traversal16 documents7 sources
Severity
6.5MEDIUMNVD
OSV8.8OSV7.8OSV6.7OSV3.3
EPSS
0.2%
top 60.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Linux KernelDebian LinuxDebian Linux+17 more
Timeline
PublishedJan 19
Latest updateMay 24

Description

fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages20 packages

▶Debianlinux/linux_kernel< 5.10.12-1+3
▶Ubuntulinux/linux_kernel< 4.4.0-204.236+2
▶NVDlinux/linux_kernel5.10.8
▶debiandebian/linux< linux 5.10.12-1 (bookworm)

Also affects: Debian Linux 9.0, Fedora 33

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

7
GHSA
GHSA-7fjq-g87x-vg8r: ** DISPUTED ** fs/nfsd/nfs3xdr↗2022-05-24
▶
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities↗2021-04-13
▶
OSV
linux-oem-5.6 vulnerabilities↗2021-04-13
▶
OSV
linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-ra↗2021-03-16
▶
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities↗2021-03-16
▶

📋Vendor Advisories

8
Ubuntu
Linux kernel vulnerabilities↗2021-04-13
▶
Ubuntu
Linux kernel (OEM) vulnerabilities↗2021-04-13
▶
Ubuntu
Linux kernel vulnerabilities↗2021-03-16
▶
Ubuntu
Linux kernel vulnerabilities↗2021-03-16
▶
Ubuntu
Linux kernel vulnerabilities↗2021-03-16
▶