IM
IronMonkey Threat Research

CVE-2021-4090 HIGH

Published: 2022-02-18 | Last Modified: 2026-08-25 | Status: Modified

Description

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.

Additional Descriptions (1)

Se encontró un fallo de escritura en memoria fuera de límites (OOB) en el NFSD del kernel de Linux. Una falta de saneo puede conllevar a una escritura más allá de bmval[bmlen-1] en nfsd4_decode_bitmap4 en el archivo fs/nfsd/nfs4xdr.c. En este fallo, un atacante local con privilegio de usuario puede conseguir acceso a memoria fuera de límites, conllevando a una amenaza para la integridad y confidencialidad del sistema

CVSS Metrics

Base Score: 7.1 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.2

Base Score: 6.6 (MEDIUM)

AV:L/AC:L/Au:N/C:C/I:C/A:N

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 9.2

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-787
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd38421c200> Operating System
linux linux_kernel 5.16 <built-in method update of dict object at 0x7fd38492bb80> Operating System
linux linux_kernel 5.16 <built-in method update of dict object at 0x7fd384929f80> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd2dbebca80> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd38421d400> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd3856474c0> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd340128ec0> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd2a039fc00> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd384928e40> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd39f963e00> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd384928b80> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

References