CVE-2021-46952 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897
https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8
https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2
https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59
https://lore.kernel.org/linux-cve-announce/20240227184057.2368370-17-gregkh@linuxfoundation.org/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2021-46952
https://www.cve.org/CVERecord?id=CVE-2021-46952

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-27T18:40:35.343Z

Updated: 2024-08-04T05:17:43.053Z

Reserved: 2024-02-25T13:45:52.722Z

Link: CVE-2021-46952

Vulnrichment

Updated: 2024-08-04T05:17:43.053Z

NVD

Status : Analyzed

Published: 2024-02-27T19:04:06.517

Modified: 2024-04-10T20:15:42.153

Link: CVE-2021-46952

Redhat

Severity : Moderate

Publid Date: 2024-02-27T00:00:00Z

Links: CVE-2021-46952 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-46952", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:45:52.722Z", "datePublished": "2024-02-27T18:40:35.343Z", "dateUpdated": "2024-08-04T05:17:43.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T04:59:26.208Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fs_context: validate UDP retrans to prevent shift out-of-bounds\n\nFix shift out-of-bounds in xprt_calc_majortimeo(). This is caused\nby a garbage timeout (retrans) mount option being passed to nfs mount,\nin this case from syzkaller.\n\nIf the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift\nvalue for a 64-bit long integer, so 'retrans' cannot be >= 64.\nIf it is >= 64, fail the mount and return an error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/fs_context.c"], "versions": [{"version": "9954bf92c0cd", "lessThan": "96fa26b74cdc", "status": "affected", "versionType": "git"}, {"version": "9954bf92c0cd", "lessThan": "2f3380121d49", "status": "affected", "versionType": "git"}, {"version": "9954bf92c0cd", "lessThan": "3d0163821c03", "status": "affected", "versionType": "git"}, {"version": "9954bf92c0cd", "lessThan": "c09f11ef3595", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/fs_context.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "custom"}, {"version": "5.10.36", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.11.20", "lessThanOrEqual": "5.11.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.12.3", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2"}, {"url": "https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897"}, {"url": "https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8"}, {"url": "https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59"}], "title": "NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46952", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T20:13:18.077870Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:02.950Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:43.053Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:43.053Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-46952", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-27T20:13:18.077870Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:41.041Z"}}], "cna": {"title": "NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9954bf92c0cd", "lessThan": "96fa26b74cdc", "versionType": "git"}, {"status": "affected", "version": "9954bf92c0cd", "lessThan": "2f3380121d49", "versionType": "git"}, {"status": "affected", "version": "9954bf92c0cd", "lessThan": "3d0163821c03", "versionType": "git"}, {"status": "affected", "version": "9954bf92c0cd", "lessThan": "c09f11ef3595", "versionType": "git"}], "programFiles": ["fs/nfs/fs_context.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"status": "unaffected", "version": "0", "lessThan": "5.6", "versionType": "custom"}, {"status": "unaffected", "version": "5.10.36", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.11.20", "versionType": "custom", "lessThanOrEqual": "5.11.*"}, {"status": "unaffected", "version": "5.12.3", "versionType": "custom", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfs/fs_context.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2"}, {"url": "https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897"}, {"url": "https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8"}, {"url": "https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fs_context: validate UDP retrans to prevent shift out-of-bounds\n\nFix shift out-of-bounds in xprt_calc_majortimeo(). This is caused\nby a garbage timeout (retrans) mount option being passed to nfs mount,\nin this case from syzkaller.\n\nIf the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift\nvalue for a 64-bit long integer, so 'retrans' cannot be >= 64.\nIf it is >= 64, fail the mount and return an error."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T04:59:26.208Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46952", "state": "PUBLISHED", "dateUpdated": "2024-08-04T05:17:43.053Z", "dateReserved": "2024-02-25T13:45:52.722Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-27T18:40:35.343Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F676E27-91BA-4675-B518-89C5729CC97C", "versionEndExcluding": "5.10.36", "versionStartIncluding": "5.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EFB425F0-C28C-4B44-8B4C-AD512AA832DE", "versionEndExcluding": "5.11.20", "versionStartIncluding": "5.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3814FA3-8141-4313-A852-8C4212BE12AD", "versionEndExcluding": "5.12.3", "versionStartIncluding": "5.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fs_context: validate UDP retrans to prevent shift out-of-bounds\n\nFix shift out-of-bounds in xprt_calc_majortimeo(). This is caused\nby a garbage timeout (retrans) mount option being passed to nfs mount,\nin this case from syzkaller.\n\nIf the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift\nvalue for a 64-bit long integer, so 'retrans' cannot be >= 64.\nIf it is >= 64, fail the mount and return an error."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFS: fs_context: valida las retransmisiones UDP para evitar cambios fuera de los l\u00edmites. Corrige cambios fuera de los l\u00edmites en xprt_calc_majortimeo(). Esto se debe a que se pasa una opci\u00f3n de montaje de tiempo de espera de basura (retransmisi\u00f3n) al montaje nfs, en este caso desde syzkaller. Si el protocolo es XPRT_TRANSPORT_UDP, entonces 'retrans' es un valor de desplazamiento para un entero largo de 64 bits, por lo que 'retrans' no puede ser >= 64. Si es >= 64, falla el montaje y devuelve un error."}], "id": "CVE-2021-46952", "lastModified": "2024-04-10T20:15:42.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-27T19:04:06.517", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f3380121d49e829fb73ba86240c181bc32ad897"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d0163821c035040a46d816a42c0780f0f0a30a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c09f11ef35955785f92369e25819bf0629df2e59"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}