Critical Vulnerability Resolved in Linux Kernel: CVE-2021-47002

What changed

The Linux kernel has undergone a significant update to resolve CVE-2021-47002, which involved a null pointer dereference in the SUNRPC subsystem. This vulnerability could lead to system instability when the function svc_rqst_free() is called with a null rq_scratch_page pointer.

The fix involves adding a null check in the svc_rqst_alloc() function to prevent dereferencing a null pointer, thereby enhancing the overall reliability of the kernel.

Who is affected

This vulnerability primarily impacts users and organizations utilizing the Linux kernel in various environments. The following groups should be particularly vigilant:

System administrators and developers who manage Linux-based servers or applications that rely on the kernel.

• Organizations using Linux distributions such as Ubuntu, CentOS, or Debian.
• Developers of applications that leverage the SUNRPC protocol.
• Cloud service providers utilizing Linux kernel-based infrastructure.

What to do

It is crucial for affected parties to take immediate action to mitigate risks associated with this vulnerability. The following steps are recommended:

Ensure that all systems running the Linux kernel are updated to the latest version that includes the fix for CVE-2021-47002.

• Regularly monitor security advisories from the Linux kernel maintainers.
• Implement a robust patch management process to apply updates promptly.
• Conduct vulnerability assessments to identify any systems still running vulnerable kernel versions.