Memory leak in Linux kernel nfs

1) Memory leak

EUVDB-ID: #VU89959

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47320

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nfs3_proc_create() and nfs3_proc_mknod() functions in fs/nfs/nfs3proc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/2e3960f276b4574a9bb0dfa31a7497302f6363b2
http://git.kernel.org/stable/c/cef9d9acb7c80ed6bace894b6334557fd493863b
http://git.kernel.org/stable/c/8a2b308a54c5ec224fedc753617f99b29ffcd883
http://git.kernel.org/stable/c/0704f617040c397ae73c1f88f3956787ec5d6529
http://git.kernel.org/stable/c/d0b32dc1409f7e65e4fcc34e236462268e69a357
http://git.kernel.org/stable/c/4b515308ab875c7e8ada8e606fe0c64762da5ed4
http://git.kernel.org/stable/c/c8fc86e9df6a6a03f5a8e15a3b7a5c75fd05aa38
http://git.kernel.org/stable/c/687cf32865b2d6960214bce523f2afac58dd3cd2
http://git.kernel.org/stable/c/1fcb6fcd74a222d9ead54d405842fc763bb86262

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.