CVE-2021-47179 (GCVE-0-2021-47179)

Vulnerability from cvelistv5 – Published: 2024-03-25 09:16 – Updated: 2026-08-05 08:46
VLAI
Title
NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Commit de144ff4234f changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a value here before dereferencing it, causing an oops. I'm able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-25 15:17 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 80e34f4957ec3010c85f9bb0b568a8d46acdf535 , < 4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42 (git)
Affected: 7b7b9774643220e53eef58c15bb29bd4182fe053 , < 42637ca25c7d7b5a92804a679af5192e8c1a9f48 (git)
Affected: 9ffa7967f9379a0a1b924e9ffeda709d72237da7 , < 39785761feadf261bc5101372b0b0bbaf6a94494 (git)
Affected: 6be0e4b59314e4a836495f6ffdc5d2c5b079deeb , < aba3c7795f51717ae316f3566442dee7cc3eeccb (git)
Affected: 2fafe7d5047f98791afd9a1d90d2afb70debc590 , < f9890652185b72b8de9ebeb4406037640b6e1b53 (git)
Affected: 7e65ea887d0c0997f3053acd91a027af45e71c5b , < b090d110e66636bca473fd8b98d5c97b555a965a (git)
Affected: de144ff4234f935bd2150108019b5d87a90a8a96 , < a421d218603ffa822a0b8045055c03eae394a7eb (git)
Affected: 96260bde1ea8ae31a5402fe506abbb8951d5a42c (git)
Affected: 5.11.20 , < 5.12 (semver)
Create a notification for this product.
Linux Linux Affected: 4.9.269 , < 4.9.271 (semver)
Affected: 4.14.233 , < 4.14.235 (semver)
Affected: 4.19.191 , < 4.19.193 (semver)
Affected: 5.4.118 , < 5.4.124 (semver)
Affected: 5.10.36 , < 5.10.42 (semver)
Affected: 5.12.3 , < 5.12.9 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47179",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-25T15:17:57.286141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:16.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42",
              "status": "affected",
              "version": "80e34f4957ec3010c85f9bb0b568a8d46acdf535",
              "versionType": "git"
            },
            {
              "lessThan": "42637ca25c7d7b5a92804a679af5192e8c1a9f48",
              "status": "affected",
              "version": "7b7b9774643220e53eef58c15bb29bd4182fe053",
              "versionType": "git"
            },
            {
              "lessThan": "39785761feadf261bc5101372b0b0bbaf6a94494",
              "status": "affected",
              "version": "9ffa7967f9379a0a1b924e9ffeda709d72237da7",
              "versionType": "git"
            },
            {
              "lessThan": "aba3c7795f51717ae316f3566442dee7cc3eeccb",
              "status": "affected",
              "version": "6be0e4b59314e4a836495f6ffdc5d2c5b079deeb",
              "versionType": "git"
            },
            {
              "lessThan": "f9890652185b72b8de9ebeb4406037640b6e1b53",
              "status": "affected",
              "version": "2fafe7d5047f98791afd9a1d90d2afb70debc590",
              "versionType": "git"
            },
            {
              "lessThan": "b090d110e66636bca473fd8b98d5c97b555a965a",
              "status": "affected",
              "version": "7e65ea887d0c0997f3053acd91a027af45e71c5b",
              "versionType": "git"
            },
            {
              "lessThan": "a421d218603ffa822a0b8045055c03eae394a7eb",
              "status": "affected",
              "version": "de144ff4234f935bd2150108019b5d87a90a8a96",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "96260bde1ea8ae31a5402fe506abbb8951d5a42c",
              "versionType": "git"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.20",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4.9.271",
              "status": "affected",
              "version": "4.9.269",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14.235",
              "status": "affected",
              "version": "4.14.233",
              "versionType": "semver"
            },
            {
              "lessThan": "4.19.193",
              "status": "affected",
              "version": "4.19.191",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.124",
              "status": "affected",
              "version": "5.4.118",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.42",
              "status": "affected",
              "version": "5.10.36",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12.9",
              "status": "affected",
              "version": "5.12.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.271",
                  "versionStartIncluding": "4.9.269",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.235",
                  "versionStartIncluding": "4.14.233",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.193",
                  "versionStartIncluding": "4.19.191",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.124",
                  "versionStartIncluding": "5.4.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.42",
                  "versionStartIncluding": "5.10.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.9",
                  "versionStartIncluding": "5.12.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()\n\nCommit de144ff4234f changes _pnfs_return_layout() to call\npnfs_mark_matching_lsegs_return() passing NULL as the struct\npnfs_layout_range argument. Unfortunately,\npnfs_mark_matching_lsegs_return() doesn\u0027t check if we have a value here\nbefore dereferencing it, causing an oops.\n\nI\u0027m able to hit this crash consistently when running connectathon basic\ntests on NFS v4.1/v4.2 against Ontap."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - This is NFSv4/pNFS client code reached while handling layout return after interaction with a remote pNFS MDS/DS peer; a malicious or compromised server can drive the return path (e.g., block/scsi layout I/O errors with PNFS_LAYOUTRET_ON_ERROR, or ordinary layout lifecycle on an active mount).\nAC:L - The crash is a deterministic NULL dereference of the missing layout-range argument and was reported as consistently reproducible on NFSv4.1/4.2 pNFS workloads; the attacker can reliably force layout return once layouts exist.\nPR:N - The attacker can be the remote NFS/pNFS server and needs no privileges on the victim client; client-local credentials are not required for the server-driven trigger.\nUI:N - In a realistic deployment the client already has an active pNFS mount (fstab/automount/infrastructure storage), so exploitation does not require a separate victim action beyond normal use of that mount.\nS:U - Impact is limited to the client kernel/NFS client security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug is a pure NULL pointer dereference of return_range with no out-of-bounds read or other information-disclosure primitive.\nI:N - There is no memory write, type confusion, or corruption path\u2014only a NULL dereference\u2014so integrity is unaffected.\nA:H - Dereferencing the NULL layout-range pointer causes a kernel oops/panic in pnfs_mark_matching_lsegs_return(), which is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:46:31.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"
        },
        {
          "url": "https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"
        },
        {
          "url": "https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"
        },
        {
          "url": "https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"
        },
        {
          "url": "https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"
        }
      ],
      "title": "NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47179",
    "datePublished": "2024-03-25T09:16:28.787Z",
    "dateReserved": "2024-03-25T09:12:14.112Z",
    "dateUpdated": "2026-08-05T08:46:31.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47179",
      "date": "2026-10-02",
      "epss": "0.00676",
      "percentile": "0.50493"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfs/pnfs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42",
                    "status": "affected",
                    "version": "80e34f4957ec3010c85f9bb0b568a8d46acdf535",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "42637ca25c7d7b5a92804a679af5192e8c1a9f48",
                    "status": "affected",
                    "version": "7b7b9774643220e53eef58c15bb29bd4182fe053",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "39785761feadf261bc5101372b0b0bbaf6a94494",
                    "status": "affected",
                    "version": "9ffa7967f9379a0a1b924e9ffeda709d72237da7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aba3c7795f51717ae316f3566442dee7cc3eeccb",
                    "status": "affected",
                    "version": "6be0e4b59314e4a836495f6ffdc5d2c5b079deeb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9890652185b72b8de9ebeb4406037640b6e1b53",
                    "status": "affected",
                    "version": "2fafe7d5047f98791afd9a1d90d2afb70debc590",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b090d110e66636bca473fd8b98d5c97b555a965a",
                    "status": "affected",
                    "version": "7e65ea887d0c0997f3053acd91a027af45e71c5b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a421d218603ffa822a0b8045055c03eae394a7eb",
                    "status": "affected",
                    "version": "de144ff4234f935bd2150108019b5d87a90a8a96",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "96260bde1ea8ae31a5402fe506abbb8951d5a42c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "affected",
                    "version": "5.11.20",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfs/pnfs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4.9.271",
                    "status": "affected",
                    "version": "4.9.269",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.14.235",
                    "status": "affected",
                    "version": "4.14.233",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.19.193",
                    "status": "affected",
                    "version": "4.19.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.4.124",
                    "status": "affected",
                    "version": "5.4.118",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.10.42",
                    "status": "affected",
                    "version": "5.10.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.12.9",
                    "status": "affected",
                    "version": "5.12.3",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "498E5552-CBDA-4FE4-8844-EE7D575C9F35",
                    "versionEndExcluding": "4.9.271",
                    "versionStartIncluding": "4.9.269",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F80A9838-744C-4554-8CCE-B87128CC7170",
                    "versionEndExcluding": "4.14.235",
                    "versionStartIncluding": "4.14.233",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE4BABC9-D544-4D14-BF94-5E999CDF4847",
                    "versionEndExcluding": "4.19.193",
                    "versionStartIncluding": "4.19.191",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "255B5502-D9A3-44BD-9B79-7C957CA4B62B",
                    "versionEndExcluding": "5.4.124",
                    "versionStartIncluding": "5.4.118",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FAF8C28F-086A-4EC2-A931-2237C11F5F54",
                    "versionEndExcluding": "5.10.42",
                    "versionStartIncluding": "5.10.36",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "148AD795-DE39-4B4E-BDFF-D6A492C22C4C",
                    "versionEndExcluding": "5.12.9",
                    "versionStartIncluding": "5.12.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()\n\nCommit de144ff4234f changes _pnfs_return_layout() to call\npnfs_mark_matching_lsegs_return() passing NULL as the struct\npnfs_layout_range argument. Unfortunately,\npnfs_mark_matching_lsegs_return() doesn\u0027t check if we have a value here\nbefore dereferencing it, causing an oops.\n\nI\u0027m able to hit this crash consistently when running connectathon basic\ntests on NFS v4.1/v4.2 against Ontap."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSv4: corrige una desreferencia de puntero NULL en pnfs_mark_matching_lsegs_return(). Confirme los cambios de144ff4234f _pnfs_return_layout() para llamar a pnfs_mark_matching_lsegs_return() pasando NULL como argumento de estructura pnfs_layout_range. Desafortunadamente, pnfs_mark_matching_lsegs_return() no verifica si tenemos un valor aqu\u00ed antes de eliminar la referencia a \u00e9l, lo que provoca un error. Puedo alcanzar este bloqueo de manera consistente cuando ejecuto pruebas b\u00e1sicas de Connectathon en NFS v4.1/v4.2 contra Ontap."
          }
        ],
        "id": "CVE-2021-47179",
        "lastModified": "2026-08-04T10:16:50.673",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47179",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-25T15:17:57.286141Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-25T10:15:09.317",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:06:41+00:00",
      "cve": "CVE-2021-47179",
      "id": "CVE-2021-47179",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47179.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:07.318Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47179",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-03-25T15:17:57.286141Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-05T15:20:38.291Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/nfs/pnfs.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42",
                  "status": "affected",
                  "version": "80e34f4957ec3010c85f9bb0b568a8d46acdf535",
                  "versionType": "git"
                },
                {
                  "lessThan": "42637ca25c7d7b5a92804a679af5192e8c1a9f48",
                  "status": "affected",
                  "version": "7b7b9774643220e53eef58c15bb29bd4182fe053",
                  "versionType": "git"
                },
                {
                  "lessThan": "39785761feadf261bc5101372b0b0bbaf6a94494",
                  "status": "affected",
                  "version": "9ffa7967f9379a0a1b924e9ffeda709d72237da7",
                  "versionType": "git"
                },
                {
                  "lessThan": "aba3c7795f51717ae316f3566442dee7cc3eeccb",
                  "status": "affected",
                  "version": "6be0e4b59314e4a836495f6ffdc5d2c5b079deeb",
                  "versionType": "git"
                },
                {
                  "lessThan": "f9890652185b72b8de9ebeb4406037640b6e1b53",
                  "status": "affected",
                  "version": "2fafe7d5047f98791afd9a1d90d2afb70debc590",
                  "versionType": "git"
                },
                {
                  "lessThan": "b090d110e66636bca473fd8b98d5c97b555a965a",
                  "status": "affected",
                  "version": "7e65ea887d0c0997f3053acd91a027af45e71c5b",
                  "versionType": "git"
                },
                {
                  "lessThan": "a421d218603ffa822a0b8045055c03eae394a7eb",
                  "status": "affected",
                  "version": "de144ff4234f935bd2150108019b5d87a90a8a96",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "96260bde1ea8ae31a5402fe506abbb8951d5a42c",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.12",
                  "status": "affected",
                  "version": "5.11.20",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/nfs/pnfs.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4.9.271",
                  "status": "affected",
                  "version": "4.9.269",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.14.235",
                  "status": "affected",
                  "version": "4.14.233",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.19.193",
                  "status": "affected",
                  "version": "4.19.191",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.4.124",
                  "status": "affected",
                  "version": "5.4.118",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.10.42",
                  "status": "affected",
                  "version": "5.10.36",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.12.9",
                  "status": "affected",
                  "version": "5.12.3",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.271",
                      "versionStartIncluding": "4.9.269",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.235",
                      "versionStartIncluding": "4.14.233",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.193",
                      "versionStartIncluding": "4.19.191",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.124",
                      "versionStartIncluding": "5.4.118",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.42",
                      "versionStartIncluding": "5.10.36",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.9",
                      "versionStartIncluding": "5.12.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.11.20",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()\n\nCommit de144ff4234f changes _pnfs_return_layout() to call\npnfs_mark_matching_lsegs_return() passing NULL as the struct\npnfs_layout_range argument. Unfortunately,\npnfs_mark_matching_lsegs_return() doesn\u0027t check if we have a value here\nbefore dereferencing it, causing an oops.\n\nI\u0027m able to hit this crash consistently when running connectathon basic\ntests on NFS v4.1/v4.2 against Ontap."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - This is NFSv4/pNFS client code reached while handling layout return after interaction with a remote pNFS MDS/DS peer; a malicious or compromised server can drive the return path (e.g., block/scsi layout I/O errors with PNFS_LAYOUTRET_ON_ERROR, or ordinary layout lifecycle on an active mount).\nAC:L - The crash is a deterministic NULL dereference of the missing layout-range argument and was reported as consistently reproducible on NFSv4.1/4.2 pNFS workloads; the attacker can reliably force layout return once layouts exist.\nPR:N - The attacker can be the remote NFS/pNFS server and needs no privileges on the victim client; client-local credentials are not required for the server-driven trigger.\nUI:N - In a realistic deployment the client already has an active pNFS mount (fstab/automount/infrastructure storage), so exploitation does not require a separate victim action beyond normal use of that mount.\nS:U - Impact is limited to the client kernel/NFS client security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug is a pure NULL pointer dereference of return_range with no out-of-bounds read or other information-disclosure primitive.\nI:N - There is no memory write, type confusion, or corruption path\u2014only a NULL dereference\u2014so integrity is unaffected.\nA:H - Dereferencing the NULL layout-range pointer causes a kernel oops/panic in pnfs_mark_matching_lsegs_return(), which is a high availability impact."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:46:31.594Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42"
            },
            {
              "url": "https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48"
            },
            {
              "url": "https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494"
            },
            {
              "url": "https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb"
            },
            {
              "url": "https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53"
            },
            {
              "url": "https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a"
            },
            {
              "url": "https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb"
            }
          ],
          "title": "NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47179",
        "datePublished": "2024-03-25T09:16:28.787Z",
        "dateReserved": "2024-03-25T09:12:14.112Z",
        "dateUpdated": "2026-08-05T08:46:31.594Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.