CVE-2021-47316 (GCVE-0-2021-47316)
Vulnerability from cvelistv5
Published
2024-05-21 14:35
Modified
2025-05-04 07:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svc_encode_getaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and d_really_is_positive(dentry), but that looks like overkill to me--zero status should be enough to guarantee a positive dentry. This isn't the first time we've seen an error-case NULL dereference hidden in the initialization of a local variable in an xdr encoder. But I went back through the other recent rewrites and didn't spot any similar bugs.
References
Impacted products
Vendor Product Version
Linux Linux Version: d505e66191072748620fc0af038cea4e4da0e3cd
Version: 20798dfe249a01ad1b12eec7dbc572db5003244a
Version: 20798dfe249a01ad1b12eec7dbc572db5003244a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T18:45:04.809482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:36.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e79057d15d96ef19de4de6d7e479bae3d58a2a8d",
              "status": "affected",
              "version": "d505e66191072748620fc0af038cea4e4da0e3cd",
              "versionType": "git"
            },
            {
              "lessThan": "650e6f383a6eb40f7c0a010982a74ab4b6893870",
              "status": "affected",
              "version": "20798dfe249a01ad1b12eec7dbc572db5003244a",
              "versionType": "git"
            },
            {
              "lessThan": "ab1016d39cc052064e32f25ad18ef8767a0ee3b8",
              "status": "affected",
              "version": "20798dfe249a01ad1b12eec7dbc572db5003244a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix NULL dereference in nfs3svc_encode_getaclres\n\nIn error cases the dentry may be NULL.\n\nBefore 20798dfe249a, the encoder also checked dentry and\nd_really_is_positive(dentry), but that looks like overkill to me--zero\nstatus should be enough to guarantee a positive dentry.\n\nThis isn\u0027t the first time we\u0027ve seen an error-case NULL dereference\nhidden in the initialization of a local variable in an xdr encoder.  But\nI went back through the other recent rewrites and didn\u0027t spot any\nsimilar bugs."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:08:32.797Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8"
        }
      ],
      "title": "nfsd: fix NULL dereference in nfs3svc_encode_getaclres",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47316",
    "datePublished": "2024-05-21T14:35:32.564Z",
    "dateReserved": "2024-05-21T14:28:16.973Z",
    "dateUpdated": "2025-05-04T07:08:32.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47316\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:18.940\",\"lastModified\":\"2024-12-24T16:28:58.957\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix NULL dereference in nfs3svc_encode_getaclres\\n\\nIn error cases the dentry may be NULL.\\n\\nBefore 20798dfe249a, the encoder also checked dentry and\\nd_really_is_positive(dentry), but that looks like overkill to me--zero\\nstatus should be enough to guarantee a positive dentry.\\n\\nThis isn\u0027t the first time we\u0027ve seen an error-case NULL dereference\\nhidden in the initialization of a local variable in an xdr encoder.  But\\nI went back through the other recent rewrites and didn\u0027t spot any\\nsimilar bugs.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: corrige la desreferencia NULL en nfs3svc_encode_getaclres. En casos de error, la dentry puede ser NULL. Antes de 20798dfe249a, el codificador tambi\u00e9n verificaba dentry y d_really_is_positive(dentry), pero eso me parece excesivo: el estado cero deber\u00eda ser suficiente para garantizar un dentry positivo. Esta no es la primera vez que vemos una desreferencia NULL de caso de error oculta en la inicializaci\u00f3n de una variable local en un codificador xdr. Pero revis\u00e9 las otras reescrituras recientes y no encontr\u00e9 ning\u00fan error similar.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.13.4\",\"matchCriteriaId\":\"F93FA3CC-0C79-410B-A7D7-245C2AA0723A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.599Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47316\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T18:45:04.809482Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.477Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"nfsd: fix NULL dereference in nfs3svc_encode_getaclres\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d505e6619107\", \"lessThan\": \"e79057d15d96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"20798dfe249a\", \"lessThan\": \"650e6f383a6e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"20798dfe249a\", \"lessThan\": \"ab1016d39cc0\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/nfs3acl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.13.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.13.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/nfs3acl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d\"}, {\"url\": \"https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870\"}, {\"url\": \"https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix NULL dereference in nfs3svc_encode_getaclres\\n\\nIn error cases the dentry may be NULL.\\n\\nBefore 20798dfe249a, the encoder also checked dentry and\\nd_really_is_positive(dentry), but that looks like overkill to me--zero\\nstatus should be enough to guarantee a positive dentry.\\n\\nThis isn\u0027t the first time we\u0027ve seen an error-case NULL dereference\\nhidden in the initialization of a local variable in an xdr encoder.  But\\nI went back through the other recent rewrites and didn\u0027t spot any\\nsimilar bugs.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-04T12:03:33.502Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47316\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-04T12:03:33.502Z\", \"dateReserved\": \"2024-05-21T14:28:16.973Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:35:32.564Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.