PT-2024-11315 · Linux+1 · Linux Kernel+1

Jianhong Yin · Published 2021-07-06 · Updated 2024-12-24 · CVE-2021-47316

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 20798dfe249a

Description A NULL dereference vulnerability has been resolved in the Linux kernel. The issue occurs in the nfsd component, specifically in the nfs3svc encode getaclres function, where the dentry may be NULL in error cases. The encoder previously checked the dentry and d really is positive(dentry), but this was considered overkill, as a zero status should be enough to guarantee a positive dentry. This is not the first instance of an error-case NULL dereference hidden in the initialization of a local variable in an xdr encoder.

Recommendations As a temporary workaround, consider disabling the nfs3svc encode getaclres function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-07393

CVE-2021-47316

Affected Products

Astra Linux

Linux Kernel

References · 16

• https://git.kernel.org/stable/c/ab1016d39cc052064e32f25ad18ef8767a0ee3b8 · Patch
• https://git.kernel.org/stable/c/650e6f383a6eb40f7c0a010982a74ab4b6893870 · Patch
• https://git.kernel.org/stable/c/e79057d15d96ef19de4de6d7e479bae3d58a2a8d · Patch
• https://ubuntu.com/security/CVE-2021-47316 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-47316 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47316 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-47316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47316 · Security Note
• https://bdu.fstec.ru/vul/2025-07393 · Security Note
• https://git.linuxtesting.ru/pub/scm/linux/kernel/git/lvc/linux-stable.git/commit/?h=v5.10.223-lvc29&id=e79057d15d96ef19de4de6d7e479bae3d58a2a8d · Note
• https://git.kernel.org/linus/ab1016d39cc052064e32f25ad18ef8767a0ee3b8 · Note
• https://t.me/cvenotify/84025 · Telegram Post
• https://git.linuxtesting.ru/pub/scm/linux/kernel/git/lvc/linux-stable.git/commit/?h=v5.10.223-lvc29&id=e79057d15d96ef19de4de6d7e479bae3d58a2a8d · Note
• https://lore.kernel.org/linux-cve-announce/2024052130-CVE-2021-47316-e2c2@gregkh · Note
• https://t.me/cvenotify/105405 · Telegram Post