CVE-2021-47168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47168", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-25T09:12:14.111Z", "datePublished": "2024-03-25T09:16:20.778Z", "dateUpdated": "2026-08-05T08:46:28.312Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:28.312Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix an incorrect limit in filelayout_decode_layout()\n\nThe \"sizeof(struct nfs_fh)\" is two bytes too large and could lead to\nmemory corruption. It should be NFS_MAXFHSIZE because that's the size\nof the ->data[] buffer.\n\nI reversed the size of the arguments to put the variable on the left."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached when the NFSv4.1 pNFS filelayout client parses a LAYOUTGET layout blob from a remote metadata server over NFS/RPC; a malicious or compromised MDS (or MITM) delivers the oversized filehandle over the network.\nAC:L - The attacker fully controls the LAYOUTGET XDR and can set fh size to 129\u2013130 to pass the incorrect sizeof check and deterministically overflow; no race or special victim-side memory layout is required.\nPR:N - Exploitation requires no privileges on the victim client\u2014the attacker only needs to be (or impersonate) the NFS metadata server sending protocol responses after a normal pNFS mount/session.\nUI:N - In the highest-impact deployment\u2014an already-mounted enterprise/HPC/cloud pNFS share (fstab/autofs)\u2014routine file I/O or LAYOUTGET-on-OPEN triggers the decode path with no further interactive victim action.\nS:U - The heap overflow corrupts memory only within the client kernel\u2019s security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is attacker-controlled heap memory corruption (OOB write of up to two bytes past the allocated nfs_fh, with oversized fh->size reused on later encode/copy paths), which can be leveraged for kernel information disclosure.\nI:H - The out-of-bounds write into the heap-allocated nfs_fh object is memory corruption suitable for adjacent-object/control-flow primitives; the same class of 1\u20132 byte NFS fh overflow (CVE-2021-4157) was assessed as privilege-escalation capable.\nA:H - Heap corruption in kernel context can cause oops/panic (and is reliably fatal under KASAN/debug allocators), fully denying availability of the client host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/filelayout/filelayout.c"], "versions": [{"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "f299522eda1566cbfbae4b15c82970fc41b03714", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "945ebef997227ca8c20bad7f8a8358c8ee57a84a", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "e411df81cd862ef3d5b878120b2a2fef0ca9cdb1", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "9b367fe770b1b80d7bf64ed0d177544a44405f6e", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "d34fb628f6ef522f996205a9e578216bbee09e84", "status": "affected", "versionType": "git"}, {"version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "769b01ea68b6c49dc3cde6adf7e53927dacbd3a8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/filelayout/filelayout.c"], "versions": [{"version": "2.6.37", "status": "affected"}, {"version": "0", "lessThan": "2.6.37", "status": "unaffected", "versionType": "semver"}, {"version": "4.4.271", "lessThanOrEqual": "4.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.271", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.235", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.193", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.124", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.42", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.12.9", "lessThanOrEqual": "5.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.4.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.9.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.14.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "4.19.193"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.4.124"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.10.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.12.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.37", "versionEndExcluding": "5.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040"}, {"url": "https://git.kernel.org/stable/c/b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1"}, {"url": "https://git.kernel.org/stable/c/f299522eda1566cbfbae4b15c82970fc41b03714"}, {"url": "https://git.kernel.org/stable/c/945ebef997227ca8c20bad7f8a8358c8ee57a84a"}, {"url": "https://git.kernel.org/stable/c/e411df81cd862ef3d5b878120b2a2fef0ca9cdb1"}, {"url": "https://git.kernel.org/stable/c/9b367fe770b1b80d7bf64ed0d177544a44405f6e"}, {"url": "https://git.kernel.org/stable/c/d34fb628f6ef522f996205a9e578216bbee09e84"}, {"url": "https://git.kernel.org/stable/c/769b01ea68b6c49dc3cde6adf7e53927dacbd3a8"}], "title": "NFS: fix an incorrect limit in filelayout_decode_layout()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.927Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f299522eda1566cbfbae4b15c82970fc41b03714", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/945ebef997227ca8c20bad7f8a8358c8ee57a84a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e411df81cd862ef3d5b878120b2a2fef0ca9cdb1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9b367fe770b1b80d7bf64ed0d177544a44405f6e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d34fb628f6ef522f996205a9e578216bbee09e84", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/769b01ea68b6c49dc3cde6adf7e53927dacbd3a8", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:54:34.857777Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:52.333Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f299522eda1566cbfbae4b15c82970fc41b03714", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/945ebef997227ca8c20bad7f8a8358c8ee57a84a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e411df81cd862ef3d5b878120b2a2fef0ca9cdb1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/9b367fe770b1b80d7bf64ed0d177544a44405f6e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d34fb628f6ef522f996205a9e578216bbee09e84", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/769b01ea68b6c49dc3cde6adf7e53927dacbd3a8", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:24:39.927Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:54:34.857777Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:19.338Z"}}], "cna": {"title": "NFS: fix an incorrect limit in filelayout_decode_layout()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached when the NFSv4.1 pNFS filelayout client parses a LAYOUTGET layout blob from a remote metadata server over NFS/RPC; a malicious or compromised MDS (or MITM) delivers the oversized filehandle over the network.\nAC:L - The attacker fully controls the LAYOUTGET XDR and can set fh size to 129\u2013130 to pass the incorrect sizeof check and deterministically overflow; no race or special victim-side memory layout is required.\nPR:N - Exploitation requires no privileges on the victim client\u2014the attacker only needs to be (or impersonate) the NFS metadata server sending protocol responses after a normal pNFS mount/session.\nUI:N - In the highest-impact deployment\u2014an already-mounted enterprise/HPC/cloud pNFS share (fstab/autofs)\u2014routine file I/O or LAYOUTGET-on-OPEN triggers the decode path with no further interactive victim action.\nS:U - The heap overflow corrupts memory only within the client kernel\u2019s security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is attacker-controlled heap memory corruption (OOB write of up to two bytes past the allocated nfs_fh, with oversized fh->size reused on later encode/copy paths), which can be leveraged for kernel information disclosure.\nI:H - The out-of-bounds write into the heap-allocated nfs_fh object is memory corruption suitable for adjacent-object/control-flow primitives; the same class of 1\u20132 byte NFS fh overflow (CVE-2021-4157) was assessed as privilege-escalation capable.\nA:H - Heap corruption in kernel context can cause oops/panic (and is reliably fatal under KASAN/debug allocators), fully denying availability of the client host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "f299522eda1566cbfbae4b15c82970fc41b03714", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "945ebef997227ca8c20bad7f8a8358c8ee57a84a", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "e411df81cd862ef3d5b878120b2a2fef0ca9cdb1", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "9b367fe770b1b80d7bf64ed0d177544a44405f6e", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "d34fb628f6ef522f996205a9e578216bbee09e84", "versionType": "git"}, {"status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "lessThan": "769b01ea68b6c49dc3cde6adf7e53927dacbd3a8", "versionType": "git"}], "programFiles": ["fs/nfs/filelayout/filelayout.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.37"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.37", "versionType": "semver"}, {"status": "unaffected", "version": "4.4.271", "versionType": "semver", "lessThanOrEqual": "4.4.*"}, {"status": "unaffected", "version": "4.9.271", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.235", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.193", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.124", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.42", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.12.9", "versionType": "semver", "lessThanOrEqual": "5.12.*"}, {"status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfs/filelayout/filelayout.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040"}, {"url": "https://git.kernel.org/stable/c/b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1"}, {"url": "https://git.kernel.org/stable/c/f299522eda1566cbfbae4b15c82970fc41b03714"}, {"url": "https://git.kernel.org/stable/c/945ebef997227ca8c20bad7f8a8358c8ee57a84a"}, {"url": "https://git.kernel.org/stable/c/e411df81cd862ef3d5b878120b2a2fef0ca9cdb1"}, {"url": "https://git.kernel.org/stable/c/9b367fe770b1b80d7bf64ed0d177544a44405f6e"}, {"url": "https://git.kernel.org/stable/c/d34fb628f6ef522f996205a9e578216bbee09e84"}, {"url": "https://git.kernel.org/stable/c/769b01ea68b6c49dc3cde6adf7e53927dacbd3a8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix an incorrect limit in filelayout_decode_layout()\n\nThe \"sizeof(struct nfs_fh)\" is two bytes too large and could lead to\nmemory corruption. It should be NFS_MAXFHSIZE because that's the size\nof the ->data[] buffer.\n\nI reversed the size of the arguments to put the variable on the left."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.271", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.271", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.235", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.193", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.124", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.42", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.12.9", "versionStartIncluding": "2.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.13", "versionStartIncluding": "2.6.37"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:46:28.312Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47168", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:46:28.312Z", "dateReserved": "2024-03-25T09:12:14.111Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-25T09:16:20.778Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfs/filelayout/filelayout.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "f299522eda1566cbfbae4b15c82970fc41b03714", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "945ebef997227ca8c20bad7f8a8358c8ee57a84a", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "e411df81cd862ef3d5b878120b2a2fef0ca9cdb1", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "9b367fe770b1b80d7bf64ed0d177544a44405f6e", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "d34fb628f6ef522f996205a9e578216bbee09e84", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}, {"lessThan": "769b01ea68b6c49dc3cde6adf7e53927dacbd3a8", "status": "affected", "version": "16b374ca439fb406e46e071f75428f5b033056f8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfs/filelayout/filelayout.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.37"}, {"lessThan": "2.6.37", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.4.*", "status": "unaffected", "version": "4.4.271", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.271", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.235", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.193", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.124", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.42", "versionType": "semver"}, {"lessThanOrEqual": "5.12.*", "status": "unaffected", "version": "5.12.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA9C0516-0AB8-4BC5-8058-1896E469EB2D", "versionEndExcluding": "4.4.271", "versionStartIncluding": "2.6.37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E7DAE3A-78E9-45DB-96D8-4541CD7DC26B", "versionEndExcluding": "4.9.271", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "03A23445-0C1A-42AB-AC5C-768360DDF32C", "versionEndExcluding": "4.14.235", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8DEF3EC-88D9-4B89-8CF9-64BD6C863C9D", "versionEndExcluding": "4.19.193", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "06FE0F99-F7A9-462A-8355-30E2EDA9826B", "versionEndExcluding": "5.4.124", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3E7E799-1C8A-45FB-9E07-4731996144C9", "versionEndExcluding": "5.10.42", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C8A1D02-81A7-44E5-ACFD-CC6A6694F930", "versionEndExcluding": "5.12.9", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix an incorrect limit in filelayout_decode_layout()\n\nThe \"sizeof(struct nfs_fh)\" is two bytes too large and could lead to\nmemory corruption. It should be NFS_MAXFHSIZE because that's the size\nof the ->data[] buffer.\n\nI reversed the size of the arguments to put the variable on the left."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFS: corrige un l\u00edmite incorrecto en filelayout_decode_layout() El \"sizeof(struct nfs_fh)\" es dos bytes demasiado grande y podr\u00eda provocar da\u00f1os en la memoria. Deber\u00eda ser NFS_MAXFHSIZE porque ese es el tama\u00f1o del b\u00fafer ->datos[]. Invert\u00ed el tama\u00f1o de los argumentos para poner la variable a la izquierda."}], "id": "CVE-2021-47168", "lastModified": "2026-08-04T10:16:50.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47168", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:54:34.857777Z", "version": "2.0.3"}}]}, "published": "2024-03-25T10:15:08.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/769b01ea68b6c49dc3cde6adf7e53927dacbd3a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/945ebef997227ca8c20bad7f8a8358c8ee57a84a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9b367fe770b1b80d7bf64ed0d177544a44405f6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d34fb628f6ef522f996205a9e578216bbee09e84"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e411df81cd862ef3d5b878120b2a2fef0ca9cdb1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f299522eda1566cbfbae4b15c82970fc41b03714"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/769b01ea68b6c49dc3cde6adf7e53927dacbd3a8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/945ebef997227ca8c20bad7f8a8358c8ee57a84a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9b367fe770b1b80d7bf64ed0d177544a44405f6e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9d280ab53df1d4a1043bd7a9e7c6a2f9cfbfe040"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b287521e9e94bb342ebe5fd8c3fd7db9aef4e6f1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d34fb628f6ef522f996205a9e578216bbee09e84"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e411df81cd862ef3d5b878120b2a2fef0ca9cdb1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f299522eda1566cbfbae4b15c82970fc41b03714"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: NFS: fix an incorrect limit in filelayout_decode_layout()", "id": "2271432", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271432"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nNFS: fix an incorrect limit in filelayout_decode_layout()\nThe \"sizeof(struct nfs_fh)\" is two bytes too large and could lead to\nmemory corruption. It should be NFS_MAXFHSIZE because that's the size\nof the ->data[] buffer.\nI reversed the size of the arguments to put the variable on the left.", "A vulnerability was found in the NFS implementation in Linux Kernel causing memory corruption due to an incorrect size limit in filelayout_decode_layout(). Using \"sizeof(struct nfs_fh)\" instead of NFS_MAXFHSIZE led to buffer overflow by two bytes leads to potential memory corruption."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2021-47168", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47168\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47168\nhttps://lore.kernel.org/linux-cve-announce/2024032536-CVE-2021-47168-2916@gregkh/T"], "threat_severity": "Moderate"}

{}