CVE-2021-3178
Summary
| CVE | CVE-2021-3178 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-01-19 07:15:00 UTC |
|---|
| Updated | 2023-11-07 03:37:00 UTC |
|---|
| Description | ** DISPUTED ** fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 33 Update: kernel-5.10.10-200.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DLA 2586-1] linux security update |
MLIST |
lists.debian.org |
|
| kernel/git/torvalds/linux.git - Linux kernel source tree |
MISC |
git.kernel.org |
Mailing List, Patch, Vendor Advisory |
| nfsd4: readdirplus shouldn't return parent of export - Patchwork |
|
patchwork.kernel.org |
|
| [SECURITY] Fedora 33 Update: kernel-5.10.10-200.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| nfsd4: readdirplus shouldn't return parent of export - Patchwork |
MISC |
patchwork.kernel.org |
Mailing List, Patch, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 180245 Debian Security Update for linux (CVE-2021-3178)
- 198295 Ubuntu Security Notification for Linux, Linux-aws, Linux-kvm, Linux-lts-xenial, Linux-raspi2, (USN-4876-1)
- 198296 Ubuntu Security Notification for Linux, Linux-aws, Linux-aws-hwe, Linux-azure, Linux-azure-4.15, (USN-4877-1)
- 198297 Ubuntu Security Notification for Linux, Linux-aws, Linux-aws-5.4, Linux-azure, Linux-azure-5.4, Linux-gcp, (USN-4878-1)
- 198326 Ubuntu Security Notification for Linux kernel vulnerabilities (USN-4910-1)
- 198328 Ubuntu Security Notification for Linux kernel (OEM) vulnerabilities (USN-4912-1)
- 353100 Amazon Linux Security Advisory for kernel : ALAC2012-2021-024
- 353101 Amazon Linux Security Advisory for kmod-mlx5 : ALAC2012-2021-025
- 353102 Amazon Linux Security Advisory for kmod-sfc : ALAC2012-2021-026
- 353131 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2022-020
- 377055 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2021:0027)
- 6140383 AWS Bottlerocket Security Update for kernel (GHSA-55p7-vpmj-5wj4)
- 670269 EulerOS Security Update for kernel (EulerOS-SA-2021-1808)
- 670320 EulerOS Security Update for kernel (EulerOS-SA-2021-1904)
- 670345 EulerOS Security Update for kernel (EulerOS-SA-2021-1879)
- 670375 EulerOS Security Update for kernel (EulerOS-SA-2021-1950)
- 670634 EulerOS Security Update for kernel (EulerOS-SA-2021-2392)
- 900098 CBL-Mariner Linux Security Update for kernel 5.4.91
- 903252 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3817)
