CVE-2021-4090: High severity Linux Linux kernel vulnerability
An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4decodebitmap4 in fs/nfsd/nfs4xdr.c.
In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, and write leading to a system integrity and confidentiality threat.
Upstream discussion:
https://lore.kernel.org/linux-nfs/97860.1636837122@crash.local/ https://lore.kernel.org/linux-nfs/163692036074.16710.5678362976688977923.stgit@klimt.1015granger.net/
Other sources
An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4decodebitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4090?
CVE-2021-4090 is classified as a high severity vulnerability due to its potential to allow local attackers to execute out-of-bounds memory writes.
How do I fix CVE-2021-4090?
To mitigate CVE-2021-4090, update the Linux kernel to version 5.16 or later.
Who is affected by CVE-2021-4090?
CVE-2021-4090 affects users of the Linux kernel versions prior to 5.16 and certain NetApp firmware.
What types of attacks can exploit CVE-2021-4090?
An attacker can exploit CVE-2021-4090 to perform out-of-bounds memory writes, potentially leading to privilege escalation or data leakage.
What components are impacted by CVE-2021-4090?
CVE-2021-4090 specifically affects the NFS server implementation in the Linux kernel.