U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

CVE-2021-47506 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.


Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
https://git.kernel.org/stable/c/04a8d07f3d58308b92630045560799a3faa3ebce
https://git.kernel.org/stable/c/148c816f10fd11df27ca6a9b3238cdd42fa72cd3
https://git.kernel.org/stable/c/2becaa990b93cbd2928292c0b669d3abb6cf06d4
https://git.kernel.org/stable/c/33645d3e22720cac1e4548f8fef57bf0649536ee
https://git.kernel.org/stable/c/348714018139c39533c55661a0c7c990671396b4
https://git.kernel.org/stable/c/548ec0805c399c65ed66c6641be467f717833ab5
https://git.kernel.org/stable/c/e0759696de6851d7536efddfdd2dfed4c4df1f09
https://git.kernel.org/stable/c/eeb0711801f5e19ef654371b627682aed3b11373

Weakness Enumeration

CWE-ID CWE Name Source

Change History

2 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-47506
NVD Published Date:
05/24/2024
NVD Last Modified:
05/24/2024
Source:
kernel.org