CVE-2021-47179

What it actually does

NULL pointer dereference in pnfs_mark_matching_lsegs_return() when pnfs_layout_range argument is NULL during NFSv4 layout return, resulting in kernel oops and crash.

Why it matters to the business

Unexpected system crashes and service interruption on Linux systems performing NFSv4 operations, leading to downtime and potential data access loss until reboot.

How an attack unfolds

An attacker with local access triggers the flaw by mounting an NFSv4.1 or NFSv4.2 share and executing layout return operations that pass NULL to the vulnerable function, reproducing the crash seen in connectathon tests.

How to fix it

Update the Linux kernel to a version containing the fix for the NULL dereference in pnfs_mark_matching_lsegs_return(); backport the resolution referenced in the commit that introduced the regression if a newer kernel is unavailable.

How to confirm the fix worked

Verify the installed kernel version contains the upstream fix, then execute NFSv4 layout return workloads to confirm absence of oops; inspect kernel source for the added NULL check before dereference.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Mount a remote NFSv4.1 or NFSv4.2 share
3. Perform layout return operations that invoke _pnfs_return_layout with NULL range
4. Trigger kernel oops and system instability

How to detect it

Search kernel logs and dmesg output for oops traces referencing pnfs_mark_matching_lsegs_return or NFS layout return functions; correlate with NFSv4 mount activity.

• pnfs_mark_matching_lsegs_return
• pnfs_layout_range
• _pnfs_return_layout
• NFSv4 layout return oops

What your security team should do

• Prioritize kernel updates on all systems using NFSv4.1 or NFSv4.2
• Restrict local user access on NFS client systems until patched
• Monitor kernel logs for NFS-related oops after applying updates