CVE-2021-47107

What it actually does

Underflow in init_dirlist buffer size calculation when READDIR count argument is too small (including zero) allows XDR stream functions to write past the allocated buffer via xdr_reserve_space pointer arithmetic in NFSD.

Why it matters to the business

NFS servers on affected kernels can be crashed or potentially compromised by local users, disrupting file sharing services and risking full system control on Linux hosts that export NFS shares.

How an attack unfolds

An attacker with local access crafts an NFS READDIR request with an undersized count argument; the server’s new entry encoders perform the faulty subtraction, the resulting negative size is passed to xdr_reserve_space, and out-of-bounds writes occur in the XDR reply buffer, enabling memory corruption.

How to fix it

Apply the upstream fix that restores proper sanity checking of the READDIR count argument and prevents the underflow; upgrade to a kernel containing the referenced commit or a later stable release that includes it.

How to confirm the fix worked

Confirm the kernel source contains the patch that adds bounds checking on the READDIR count before calling init_dirlist; recompile, boot the new kernel, and exercise READDIR with count=0 to verify no overflow occurs.

Typical attack path

1. Obtain local shell on an NFS server host
2. Mount or otherwise trigger an NFSD READDIR operation with count set to zero or other small value
3. Trigger underflow in buffer-size math inside init_dirlist
4. Cause xdr_reserve_space to compute an invalid pointer and write beyond buffer bounds
5. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and NFS server traces for unexpected XDR buffer errors or crashes during READDIR handling; correlate with any local processes issuing minimal-count directory listings.

What your security team should do

• Prioritize patching all Linux kernels that run nfsv4 or nfsv3 servers within the next 30 days
• Restrict local access to NFS server hosts until patched
• Monitor for any custom or low-level NFS clients that send minimal count values