CVE-2021-4157

What it actually does

Out-of-bounds write of one or two bytes in the Linux kernel NFS subsystem when mirroring is used, allowing a local user with NFS mount access to corrupt memory and trigger a crash or privilege escalation.

Why it matters to the business

Systems using NFS replication may experience unexpected downtime or unauthorized access, increasing operational risk for organizations that rely on Linux-based file services across many deployments.

How an attack unfolds

An attacker who already has access to an NFS mount configures mirroring replication and supplies crafted requests that trigger the out-of-bounds write, resulting in kernel memory corruption that can be leveraged for denial of service or local privilege escalation.

How to fix it

Apply the latest available kernel updates that contain the fix for the NFS mirroring flaw; if no fixed version is listed for a specific distribution, upgrade to a kernel release published after March 2022 that addresses this issue and verify the change is present in the running kernel.

How to confirm the fix worked

Confirm the installed kernel version is newer than the vulnerable release, review the NFS subsystem source for the applied bounds check, and test mirroring operations under load to ensure no crash or escalation occurs.

Typical attack path

1. Obtain access to a mounted NFS share
2. Enable or trigger mirroring/replication of files
3. Craft and submit requests that exercise the vulnerable mirroring path
4. Trigger the one- or two-byte out-of-bounds write to corrupt kernel memory
5. Leverage memory corruption for crash or privilege escalation

How to detect it

Review system logs for NFS-related kernel oops, panics, or memory corruption messages; correlate with unusual mirroring activity or privilege changes on hosts using NFS.

What your security team should do

• Prioritize kernel updates on all systems exposing NFS shares
• Restrict NFS mount access to trusted clients only
• Disable mirroring replication where it is not required
• Monitor for kernel oops or panic events related to NFS