CVE-2021-4090

What it actually does

Out-of-bounds memory write in nfsd4_decode_bitmap4 caused by missing sanity check allowing write beyond bmval[bmlen-1] in the Linux kernel NFS server.

Why it matters to the business

Local users can compromise kernel memory integrity and confidentiality on affected Linux systems, potentially leading to privilege escalation or data exposure in environments using NFSv4.

How an attack unfolds

A local attacker with user privileges crafts a malicious NFSv4 bitmap4 request that triggers the missing bounds check in nfsd4_decode_bitmap4, resulting in an out-of-bounds write that can be leveraged for memory corruption and further system compromise.

How to fix it

Update the Linux kernel to the fixed commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or apply the corresponding stable kernel update that resolves the bitmap sanity check.

How to confirm the fix worked

Verify the kernel source contains the fix commit df0cc57e057f18e44dac8e6c18aba47ab53202f9, rebuild and deploy the patched kernel, then confirm the nfsd4_decode_bitmap4 function includes proper bounds validation on bmlen.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Send specially crafted NFSv4 requests targeting the bitmap decoding path
3. Trigger the out-of-bounds write in nfsd4_decode_bitmap4
4. Leverage memory corruption to read or alter kernel memory for privilege escalation or data theft

How to detect it

Review kernel logs and audit records for unusual NFSv4 request patterns or crashes in nfsd; correlate with local user activity around NFS server processes.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NFSv4 services
• Restrict local user access where possible until patches are applied
• Monitor for kernel updates and schedule testing in non-production environments first
• Review NFS configuration to limit exposure of the NFS server component