248 lines
12 KiB
JSON
248 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2021-47307",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-05-21T13:27:52.133Z",
|
|
"datePublished": "2024-05-21T14:35:26.667Z",
|
|
"dateUpdated": "2026-08-05T08:47:11.403Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:47:11.403Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL deref in cifs_compose_mount_options()\n\nThe optional @ref parameter might contain an NULL node_name, so\nprevent dereferencing it in cifs_compose_mount_options().\n\nAddresses-Coverity: 1476408 (\"Explicit null dereferenced\")"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The NULL deref is in CIFS client DFS referral handling (cifs_compose_mount_options via expand_dfs_referral/do_dfs_failover in cifs_mount), which processes attacker-controlled referral data from a remote SMB/DFS peer over the network, matching other malicious-server CIFS client scores.\nAC:L - Once the client mounts or chases DFS against a referral with a NULL node_name, cifs_build_devname(ref->node_name) deterministically faults with no race or other condition outside the attacker's influence.\nPR:N - The attacker is the malicious or compromised SMB/DFS server and needs no privileges or credentials on the victim host; referral processing runs as part of normal client mount/DFS handling.\nUI:N - In the worst reasonable deployment (fstab/autofs/cifsroot DFS mounts, or automounted DFS junctions under an already-mounted root that re-enter cifs_mount), mount-time referral expansion runs without an exploit-time interactive victim action.\nS:U - A kernel oops in the host CIFS client stays within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - This is a pure NULL pointer dereference of ref->node_name with no out-of-bounds read, UAF, or other information-disclosure primitive.\nI:N - The defect only crashes on NULL dereference in cifs_build_devname; it does not corrupt memory or provide a write or code-execution primitive.\nA:H - Dereferencing NULL node_name causes a kernel oops/panic during DFS mount option composition, fully denying availability and repeatable on subsequent mounts/referral chases."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/cifs/cifs_dfs_ref.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2c55608f28444c3f33b10312881384c470ceed56",
|
|
"lessThan": "f7d1fa65e74263d11f90ddd33b4d4cd905a93759",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2c55608f28444c3f33b10312881384c470ceed56",
|
|
"lessThan": "e58c162789becede894d3e94c0ce6695a2ef5796",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2c55608f28444c3f33b10312881384c470ceed56",
|
|
"lessThan": "ae3d181f4e912f51af7776ea165f199b16fc165d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2c55608f28444c3f33b10312881384c470ceed56",
|
|
"lessThan": "03313d1c3a2f086bb60920607ab79ac8f8578306",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/cifs/cifs_dfs_ref.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.28",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.28",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.135",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.53",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.13.5",
|
|
"lessThanOrEqual": "5.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.14",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.28",
|
|
"versionEndExcluding": "5.4.135"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.28",
|
|
"versionEndExcluding": "5.10.53"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.28",
|
|
"versionEndExcluding": "5.13.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.28",
|
|
"versionEndExcluding": "5.14"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306"
|
|
}
|
|
],
|
|
"title": "cifs: prevent NULL deref in cifs_compose_mount_options()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-06-12T15:23:12.230114Z",
|
|
"id": "CVE-2021-47307",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-06-12T15:23:18.690Z"
|
|
}
|
|
},
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-04T05:32:08.503Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |