Junglewise Threat Intelligence

CVE-2021-38202: Linux Kernel out-of-bounds read in nfsd tracepoint

CVE-2021-38202 · Severity: high · CVSS 7.5 · Published 2021-08-08

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a remote attacker to crash the system. This occurs when specific diagnostic tracing features are enabled and the system receives specially crafted network traffic. An exploit would result in a denial of service, potentially disrupting business operations and data availability.

Technical details

An out-of-bounds read vulnerability exists in fs/nfsd/trace.h within the Linux kernel's NFS server (nfsd) implementation. The issue stems from the nfsd_dirent tracepoint using __assign_str(), which internally calls strlen() on a string that is not guaranteed to be NUL-terminated. A remote attacker can trigger this by sending specific NFS traffic while the trace event framework is active for nfsd. This leads to a kernel oops or system crash (Denial of Service). The vulnerability was fixed in Linux kernel version 5.13.4 by removing the redundant and unsafe __assign_str() call.

Affected products

  • Linux Linux Kernel before 5.13.4
  • Siemens SIMATIC S7-1500 TM MFP All versions using GNU/Linux subsystem
  • NetApp Element Software -
  • NetApp HCI Storage Node -

Timeline

  • 2021-07-20: patched: Fixed in Linux kernel version 5.13.4
  • 2021-08-08: disclosed: NVD publication date
  • 2024-04-09: advisory: Siemens published advisory SSA-265688 covering this CVE

References

Related threats