CVE-2021-47506

Advisory lineage Upstream: 0 Downstream: 20
Analyzed
Published: 24 May 2024, 15:01
Last modified:11 May 2026, 13:55

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (nvd)
EPSS Score
0.01% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 May 2024, 15:01
Published
Vulnerability first disclosed
11 May 2026, 13:55
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.01%• Percentile: 2%

Techniques & Countermeasures

  • CWE-416•Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

  • linux•linux

    ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < 04a8d07f3d58308b92630045560799a3faa3ebce | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < 348714018139c39533c55661a0c7c990671396b4 | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < 33645d3e22720cac1e4548f8fef57bf0649536ee | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < 2becaa990b93cbd2928292c0b669d3abb6cf06d4 | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < e0759696de6851d7536efddfdd2dfed4c4df1f09 | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < eeb0711801f5e19ef654371b627682aed3b11373 | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < 148c816f10fd11df27ca6a9b3238cdd42fa72cd3 | ≥ dff1399f8addf7129c49bb2227469da79cc30b47, < 548ec0805c399c65ed66c6641be467f717833ab5 | 3.17

  • linux•linux_kernel

    < 4.4.296 | ≥ 4.5, < 4.9.294 | ≥ 4.10, < 4.14.259 | ≥ 4.15, < 4.19.222 | ≥ 4.20, < 5.4.168 | ≥ 5.5, < 5.10.85 | ≥ 5.11, < 5.15.8 | 5.15:rc1 | 5.15:rc2 | 5.15:rc3 | 5.15:rc4

References (8)