This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-4090 →

DEBIAN-CVE-2021-4090

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_...

Original description

The description as published by the source.

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.5-1"}]}]

Debian:13 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.5-1"}]}]

Debian:14 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.5-1"}]}]

References

advisory security-tracker.debian.org