PT-2021-4120 · Linux+3 · Linux Kernel+3

Published 2021-07-06 · Updated 2023-05-17 · CVE-2021-38202

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.13.4

Description The issue is related to a denial of service caused by an out-of-bounds read in the strlen function within the fs/nfsd/trace.h component of the Linux kernel. This can be exploited by remote attackers sending NFS traffic when the trace event framework is being used for nfsd.

Recommendations For Linux kernel versions prior to 5.13.4, update to version 5.13.4 or later to resolve the issue. As a temporary workaround, consider restricting NFS traffic when the trace event framework is in use for nfsd until a patch is applied.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2021-2284

ALT-PU-2021-2486

ALT-PU-2021-2616

ALT-PU-2021-3563

ALT-PU-2021-3573

ALT-PU-2022-1240

ALT-PU-2022-1419

ALT-PU-2022-1421

ALT-PU-2023-1814

AZL-6586

BDU:2021-04710

CVE-2021-38202

USN-5096-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Ubuntu

References · 34

• https://github.com/torvalds/linux/commit/7b08cf62b1239a4322427d677ea9363f0ab677c6 · Patch
• https://ubuntu.com/security/notices/USN-5096-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38202 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-38202 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38160 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38204 · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35477 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37159 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34556 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38203 · Vendor Advisory