CVE-2021-42972
📋 TL;DR
This vulnerability in NoMachine Server allows local attackers to execute arbitrary code with kernel privileges or cause denial of service via memory corruption. It affects NoMachine Server versions above 4.0.346 and below 7.7.4. Attackers need local access to exploit the buffer overflow in the IOCTL handler.
💻 Affected Systems
- NoMachine Server
📦 What is this software?
Server by Nomachine
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with kernel-level code execution leading to persistent backdoor installation, data theft, and full control of affected systems.
Likely Case
Local privilege escalation from limited user to SYSTEM/root access, enabling lateral movement and persistence within the environment.
If Mitigated
Denial of service causing system crashes and service disruption without code execution if exploit fails or protections are in place.
🎯 Exploit Status
Exploitation requires local access but buffer overflow in kernel driver makes reliable exploitation feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.7.4 and later
Vendor Advisory: https://www.nomachine.com/
Restart Required: Yes
Instructions:
1. Download NoMachine Server version 7.7.4 or later from official website. 2. Stop NoMachine service. 3. Install updated version. 4. Restart system to ensure kernel driver updates take effect.
🔧 Temporary Workarounds
Restrict local access
allLimit user accounts with local access to NoMachine servers to trusted administrators only.
Disable unnecessary services
linuxDisable NoMachine Server on systems where remote access is not required.
sudo systemctl stop nomachine
sudo systemctl disable nomachine
🧯 If You Can't Patch
- Isolate NoMachine servers in separate network segments with strict access controls.
- Implement application allowlisting to prevent execution of unauthorized binaries even with elevated privileges.
🔍 How to Verify
Check if Vulnerable:
Check NoMachine Server version via GUI or configuration files. On Linux: check /usr/NX/etc/server.cfg or run 'nxserver --version'.Check Version:
nxserver --versionVerify Fix Applied:
Confirm version is 7.7.4 or higher and verify kernel driver version matches.📡 Detection & Monitoring
Log Indicators:
- Kernel crash dumps
- System instability after local user access
- Unexpected privilege escalation events
Network Indicators:
- Unusual outbound connections from NoMachine servers post-local access
SIEM Query:
EventID=41 OR (source="kernel" AND "crash") OR (process="nxserver" AND privilege_change)