| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024052147-CVE-2021-47260-4a4b@gregkh> Date: Tue, 21 May 2024 16:20:14 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2021-47260: NFS: Fix a potential NULL dereference in nfs_get_client() Description =========== In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential NULL dereference in nfs_get_client() None of the callers are expecting NULL returns from nfs_get_client() so this code will lead to an Oops. It's better to return an error pointer. I expect that this is dead code so hopefully no one is affected. The Linux kernel CVE team has assigned CVE-2021-47260 to this issue. Affected and fixed versions =========================== Issue introduced in 3.17 with commit 31434f496abb and fixed in 4.4.273 with commit fab8bfdfb4aa Issue introduced in 3.17 with commit 31434f496abb and fixed in 4.9.273 with commit a979e6010009 Issue introduced in 3.17 with commit 31434f496abb and fixed in 4.14.237 with commit 634f17ff1d59 Issue introduced in 3.17 with commit 31434f496abb and fixed in 4.19.195 with commit 4b380a7d84ef Issue introduced in 3.17 with commit 31434f496abb and fixed in 5.4.126 with commit 0057ecef9f32 Issue introduced in 3.17 with commit 31434f496abb and fixed in 5.10.44 with commit 279ad78a00f8 Issue introduced in 3.17 with commit 31434f496abb and fixed in 5.12.11 with commit 58ddf61f10b8 Issue introduced in 3.17 with commit 31434f496abb and fixed in 5.13 with commit 09226e8303be Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47260 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nfs/client.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fab8bfdfb4aac9e4e8363666333adfdf21e89106 https://git.kernel.org/stable/c/a979e601000982a3ca693171a6d4dffc47f8ad00 https://git.kernel.org/stable/c/634f17ff1d59905eb3b4bbbc00805961d08beaee https://git.kernel.org/stable/c/4b380a7d84ef2ce3f4f5bec5d8706ed937ac6502 https://git.kernel.org/stable/c/0057ecef9f324007c0ba5fcca4ddd131178ce78b https://git.kernel.org/stable/c/279ad78a00f8b9c5ff24171a59297187a3bd44b7 https://git.kernel.org/stable/c/58ddf61f10b8f9b7b1341644bfee2f1c6508d4e1 https://git.kernel.org/stable/c/09226e8303beeec10f2ff844d2e46d1371dc58e0
Powered by blists - more mailing lists