CVE-2021-4157
📋 TL;DR
This vulnerability is an out-of-bounds memory write flaw in the Linux kernel's NFS subsystem, specifically affecting mirroring/replication functionality. It allows authenticated users with NFS mount access to potentially crash the system or escalate privileges. Systems using NFS with mirroring enabled are affected.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Communications Cloud Native Core Binding Support Function by Oracle
View all CVEs affecting Communications Cloud Native Core Binding Support Function →
Communications Cloud Native Core Binding Support Function by Oracle
View all CVEs affecting Communications Cloud Native Core Binding Support Function →
Communications Cloud Native Core Binding Support Function by Oracle
View all CVEs affecting Communications Cloud Native Core Binding Support Function →
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via privilege escalation leading to root access, or system crash causing denial of service.
Likely Case
System crash/denial of service due to kernel panic from memory corruption.
If Mitigated
No impact if NFS mirroring is disabled or proper access controls prevent unauthorized NFS mount access.
🎯 Exploit Status
Requires authenticated access to NFS mount and knowledge of NFS mirroring functionality. Memory corruption is limited to 1-2 bytes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 5.14-rc1 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2034342
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 5.14-rc1 or later. 2. For distributions: Use package manager (yum update kernel / apt-get upgrade linux-image). 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable NFS mirroring
linuxDisable NFS mirroring/replication functionality if not required
Check NFS configuration files for mirroring options and remove/disable them
Restrict NFS access
linuxLimit NFS mount access to trusted users only
Configure /etc/exports with restrictive permissions (e.g., ro,sync,no_root_squash only where needed)
🧯 If You Can't Patch
- Disable NFS mirroring functionality completely
- Implement strict network segmentation to isolate NFS servers from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is earlier than 5.14-rc1 and NFS mirroring is enabled, system is vulnerable.Check Version:
uname -rVerify Fix Applied:
After patching, verify kernel version is 5.14-rc1 or later with uname -r and test NFS mirroring functionality.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs, NFS error messages related to mirroring operations, memory corruption warnings in dmesg
Network Indicators:
- Unusual NFS mirroring traffic patterns, repeated connection attempts to NFS mirroring ports
SIEM Query:
source="kernel" AND ("panic" OR "Oops" OR "general protection fault") AND process="nfs"🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=2034342
- https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/
- https://security.netapp.com/advisory/ntap-20220602-0007/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2034342
- https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/
- https://security.netapp.com/advisory/ntap-20220602-0007/
- https://www.oracle.com/security-alerts/cpujul2022.html
