Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a remote attacker to crash the system. This occurs when specific diagnostic tracing features are enabled and the system receives specially crafted network traffic. An exploit would result in a denial of service, potentially disrupting business operations and data availability.
Technical details
An out-of-bounds read vulnerability exists in fs/nfsd/trace.h within the Linux kernel's NFS server (nfsd) implementation. The issue stems from the nfsd_dirent tracepoint using __assign_str(), which internally calls strlen() on a string that is not guaranteed to be NUL-terminated. A remote attacker can trigger this by sending specific NFS traffic while the trace event framework is active for nfsd. This leads to a kernel oops or system crash (Denial of Service). The vulnerability was fixed in Linux kernel version 5.13.4 by removing the redundant and unsafe __assign_str() call.
Affected products
- Linux Linux Kernel before 5.13.4
- Siemens SIMATIC S7-1500 TM MFP All versions using GNU/Linux subsystem
- NetApp Element Software -
- NetApp HCI Storage Node -
Timeline
- 2021-07-20: patched: Fixed in Linux kernel version 5.13.4
- 2021-08-08: disclosed: NVD publication date
- 2024-04-09: advisory: Siemens published advisory SSA-265688 covering this CVE