PT-2021-8069 · Linux+3 · Linux Kernel+3

Rtm · Published 2021-12-13 · Updated 2023-08-14 · CVE-2021-4090

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an out-of-bounds memory write flaw in the NFSD of the Linux kernel, specifically in the nfsd4 decode bitmap4() function. This flaw may allow a local attacker with user privileges to access out-of-bounds memory, posing a threat to system integrity and confidentiality. The vulnerability is caused by missing sanity checks, which may lead to a write beyond bmval[bmlen-1] in fs/nfsd/nfs4xdr.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2022-1175

ALT-PU-2022-1647

ALT-PU-2022-2155

ALT-PU-2023-1684

ALT-PU-2023-1741

ALT-PU-2023-1814

ALT-PU-2023-4894

AZL-8654

BDU:2024-06253

CVE-2021-4090

USN-5217-1

USN-5265-1

USN-5362-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Ubuntu

References · 47

• https://ubuntu.com/security/CVE-2021-4155 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42739 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5265-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3752 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3772 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0742 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4090 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4090 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4090 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5217-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-8654 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42327 · Vendor Advisory