Bug 1992271 (CVE-2021-38199)

Summary:	CVE-2021-38199 kernel: incorrect connection-setup ordering allows operators of remote NFSv4 servers to cause a DoS
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, allarkin, bhu, blc, chwhite, crwood, dvlasenk, hdegoede, hkrzesin, jarod, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rvrbovsk, steved, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Linux kernel 5.14-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the hanging of mounts in the Linux kernel's NFS4 subsystem where remote servers are unreachable for the client during migration of data from one server to another (during trunking detection). This flaw allows a remote NFS4 server (if the client is connected) to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1992272, 1993211, 1993212, 1993213
Bug Blocks:	1992273

Description Guilherme de Almeida Suckevicz 2021-08-10 20:27:24 UTC

fs/nfs/nfs4client.c in the NFS4 subsystem of the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.

Reference and upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd99e9f98fbf423ff6d365b37a98e8879170f17c

Comment 1 Guilherme de Almeida Suckevicz 2021-08-10 20:27:57 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1992272]

Comment 2 Justin M. Forbes 2021-08-11 21:26:39 UTC

This was fixed for Fedora with the 5.13.4 stable kernel updates.