CVE-2021-47506
Description
A flaw was found in the Linux kernel's Network File System daemon (nfsd). A race condition during delegation handling allows a delegation break callback to be processed before the delegation is properly registered and tracked. This causes the delegation memory structure to be freed while still referenced on the recall list, resulting in a use-after-free flaw. An attacker could exploit this vulnerability to cause memory corruption, potentially leading to a Denial of Service (DoS) or arbitrary code execution.
Statement
This flaw is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires winning a timing-dependent race condition on hosts explicitly deployed as NFS file servers, limiting broader exposure. By default, Red Hat Enterprise Linux installations do not enable or run the kernel NFS server daemon. Although memory corruption resulting in a kernel crash or system instability is possible, triggering the condition depends on concurrent delegation break operations that are difficult to induce reliably.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | 7.8 | 9.8 |
| Attack Vector | Local | Local | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
