CVE-2021-47259
published 2024-05-21CVE-2021-47259: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4_init_client() KASAN reports a use-after-free when…
PriorityP343high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
1.11%
62.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different
exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7
and 5.10, but I traced the patch that introduced the clear_bit() call to
4.13. So something must have changed in the refcounting of the clp
pointer to make this call to nfs_put_client() the very last one.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.46-1 (bookworm) | linux 5.10.46-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da < c7eab9e2d7b4e983ce280276fb920af649955897 | c7eab9e2d7b4e983ce280276fb920af649955897 |
| linux | linux | >= 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da < 42c10b0db064e45f5c5ae7019bbf2168ffab766c | 42c10b0db064e45f5c5ae7019bbf2168ffab766c |
| linux | linux | >= 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da < 3e3c7ebbfac152d08be75c92802a64a1f6471a15 | 3e3c7ebbfac152d08be75c92802a64a1f6471a15 |
| linux | linux | >= 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da < c3b6cf64dfe4ef96e7341508d50d6998da7062c7 | c3b6cf64dfe4ef96e7341508d50d6998da7062c7 |
| linux | linux | >= 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da < 72651c6579a25317a90536181d311c663d0329ab | 72651c6579a25317a90536181d311c663d0329ab |
| linux | linux | >= 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da < 476bdb04c501fc64bf3b8464ffddefc8dbe01577 | 476bdb04c501fc64bf3b8464ffddefc8dbe01577 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 4.13 < 4.14.237 | 4.14.237 |
| linux | linux_kernel | >= 4.15 < 4.19.195 | 4.19.195 |
| linux | linux_kernel | >= 4.20 < 5.4.126 | 5.4.126 |
| linux | linux_kernel | >= 5.11 < 5.12.11 | 5.12.11 |
| linux | linux_kernel | >= 5.5 < 5.10.44 | 5.10.44 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: NFS: Fix use-after-free in nfs4_init_client()
vendor_redhat·2024-05-21·CVSS 7.5
CVE-2021-47259 [HIGH] CWE-416 kernel: NFS: Fix use-after-free in nfs4_init_client()
kernel: NFS: Fix use-after-free in nfs4_init_client()
In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different
exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7
and 5.10, but I traced the patch that introduced the clear_bit() call to
4.13. So something must have changed in the refcounting of the clp
pointer to make this call to nfs_put_client() the very last one.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 7) - Out of support scope
Package:
Debian
CVE-2021-47259: linux - In the Linux kernel, the following vulnerability has been resolved: NFS: Fix us...
vendor_debian·2021·CVSS 7.5
CVE-2021-47259 [HIGH] CVE-2021-47259: linux - In the Linux kernel, the following vulnerability has been resolved: NFS: Fix us...
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4_init_client() KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server. Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
Scope: local
bookworm: resolved (fixed in 5.10.46-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.10.46-1)
sid: resolved (fixed in 5.10.46-1)
trixie: resolved (fixed in 5.10.46-1)
GHSA
GHSA-w7j7-m99g-gcgq: In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free whe
ghsa_unreviewed·2024-05-21
CVE-2021-47259 [HIGH] CWE-416 GHSA-w7j7-m99g-gcgq: In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free whe
In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix use-after-free in nfs4_init_client()
KASAN reports a use-after-free when attempting to mount two different
exports through two different NICs that belong to the same server.
Olga was able to hit this with kernels starting somewhere between 5.7
and 5.10, but I traced the patch that introduced the clear_bit() call to
4.13. So something must have changed in the refcounting of the clp
pointer to make this call to nfs_put_client() the very last one.
OSV
CVE-2021-47259: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4_init_client() KASAN reports a use-after-free when
osv·2024-05-21·CVSS 7.5
CVE-2021-47259 [HIGH] CVE-2021-47259: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4_init_client() KASAN reports a use-after-free when
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4_init_client() KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server. Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766chttps://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329abhttps://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766chttps://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329abhttps://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897
2024-05-21
Published