Is CVE-2021-4090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-4090 being exploited in the wild.

How severe is CVE-2021-4090?

High severity, with a CVSS score of 7.1, published 18 February 2022.

Which products and versions are affected?

Linux Kernel Fixed in 5.16-rc2; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

Is there a fix for CVE-2021-4090?

A patch was published on 2021-11-14: Upstream patch submitted by Chuck Lever Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-4090 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2021-4090?

Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-4090: Linux Kernel NFSD out-of-bounds write in nfsd4_decode_bitmap4

CVE-2021-4090 · Severity: high · CVSS 7.1 · Published 2022-02-18

A security vulnerability has been identified in the Linux kernel's Network File System (NFS) server component. This flaw allows a local user with standard privileges to write data to restricted memory areas that should be inaccessible. An attacker could exploit this to compromise the integrity of the system or access sensitive information, potentially leading to a full system takeover.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Vendors: Linux, Siemens.

Quick answers

Is CVE-2021-4090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-4090 being exploited in the wild.
How severe is CVE-2021-4090?: High severity, with a CVSS score of 7.1, published 18 February 2022.
Which products and versions are affected?: Linux Kernel Fixed in 5.16-rc2; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.
Is there a fix for CVE-2021-4090?: A patch was published on 2021-11-14: Upstream patch submitted by Chuck Lever Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-4090 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2021-4090?: Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) memory write flaw was discovered in the NFSD (NFS server) implementation within the Linux kernel. The vulnerability resides in the nfsd4_decode_bitmap4 function in fs/nfsd/nfs4xdr.c, where a lack of proper input validation allows a write beyond the allocated bmval array. A local attacker with user-level privileges can trigger this overflow via specially crafted RPC requests, specifically affecting nfsd4_decode_exchange_id() calls. This can lead to the corruption of kernel memory, threatening system confidentiality and integrity. The issue was addressed by rewriting the decoding loops to ensure they do not iterate beyond the defined bitmap length.

Affected products

Linux Linux Kernel Fixed in 5.16-rc2
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions

Timeline

2021-11-14: patched: Upstream patch submitted by Chuck Lever
2021-11-19: disclosed: Bug reported to Red Hat Bugzilla
2022-02-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.