CVE-2021-38202: Linux Kernel NFS DoS Vulnerability

CVE-2021-38202 Overview

CVE-2021-38202 is an out-of-bounds read vulnerability in the Linux kernel's NFS daemon (nfsd) trace event framework. The flaw exists in fs/nfsd/trace.h in Linux kernel versions before 5.13.4, where remote attackers can cause a denial of service condition by sending specially crafted NFS traffic when the trace event framework is being used for nfsd operations.

Critical Impact

Remote attackers can trigger an out-of-bounds read in the strlen function, causing system crashes or service disruption on NFS servers with tracing enabled.

Affected Products

• Linux Kernel (versions before 5.13.4)
• NetApp HCI Bootstrap OS
• NetApp HCI Compute Node
• NetApp HCI Management Node
• NetApp SolidFire
• NetApp Element Software
• NetApp HCI Storage Node

Discovery Timeline

• 2021-08-08 - CVE-2021-38202 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-38202

Vulnerability Analysis

This vulnerability is an out-of-bounds read condition (CWE-125) that occurs in the NFS daemon's tracing subsystem. The root issue lies in the nfs_dirent tracepoint implementation within fs/nfsd/trace.h. When NFS tracing is enabled and the server processes directory entries, the code improperly handles string assignment operations, which can lead to reading memory beyond allocated buffer boundaries when processing NFS traffic.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly dangerous for publicly accessible NFS servers. Successful exploitation results in a denial of service condition, potentially crashing the affected system or causing service disruption.

Root Cause

The vulnerability stems from improper handling of the __assign_str macro in the trace event definition. The code performed a redundant and incorrect string assignment after already copying the name buffer with memcpy. This created a situation where strlen could be called on data that wasn't properly null-terminated, leading to out-of-bounds memory reads.

Attack Vector

The attack can be executed remotely over the network by sending malicious NFS traffic to a vulnerable server that has nfsd tracing enabled. The attacker does not require any privileges or user interaction to exploit this vulnerability. The attack specifically targets the trace event framework's handling of directory entry names during NFS operations.

 		__entry->ino = ino;
 		__entry->len = namlen;
 		memcpy(__get_str(name), name, namlen);
-		__assign_str(name, name);
 	),
 	TP_printk("fh_hash=0x%08x ino=%llu name=%.*s",
 		__entry->fh_hash, __entry->ino,

Source: GitHub Commit 7b08cf6

Detection Methods for CVE-2021-38202

Indicators of Compromise

• Unexpected kernel crashes or panics on NFS servers with stack traces referencing nfsd or trace event functions
• System log entries indicating out-of-bounds memory access in NFS-related kernel modules
• Unusual NFS traffic patterns or malformed directory listing requests
• Service disruption affecting NFS exports without apparent cause

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for out-of-bounds read errors or oops messages related to nfsd
• Implement network intrusion detection rules to identify anomalous NFS protocol traffic
• Use kernel memory debugging tools (KASAN) in test environments to detect memory access violations
• Deploy SentinelOne Singularity Platform for real-time kernel-level threat detection and behavioral analysis

Monitoring Recommendations

• Enable system auditing for NFS daemon activities and trace framework usage
• Configure alerting on kernel panic events and unexpected service restarts
• Monitor system stability metrics for NFS servers, particularly those with tracing enabled
• Review NFS access logs for unusual patterns from untrusted network sources

How to Mitigate CVE-2021-38202

Immediate Actions Required

• Upgrade affected Linux kernel installations to version 5.13.4 or later
• Disable nfsd tracing if upgrading is not immediately possible
• Restrict NFS access to trusted network segments using firewall rules
• Review and audit NFS export configurations to minimize attack surface

Patch Information

The vulnerability was addressed in Linux kernel version 5.13.4. The fix removes the redundant __assign_str macro call that caused the out-of-bounds read condition. The patch is available through the official kernel repository.

For detailed patch information, refer to:

• Linux Kernel ChangeLog 5.13.4
• GitHub Commit 7b08cf6

NetApp customers should consult the NetApp Security Advisory NTAP-20210902-0010 for product-specific guidance.

Workarounds

• Disable nfsd tracing by not enabling trace events for the nfsd subsystem
• Implement network-level access controls to restrict NFS traffic to trusted hosts only
• Consider using NFS over VPN or other secured network segments to limit exposure
• Deploy intrusion prevention systems with rules to detect and block malicious NFS traffic

# Disable nfsd trace events (temporary workaround)
echo 0 > /sys/kernel/debug/tracing/events/nfsd/enable

# Verify nfsd tracing is disabled
cat /sys/kernel/debug/tracing/events/nfsd/enable

# Restrict NFS access via iptables (example)
iptables -A INPUT -p tcp --dport 2049 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP