GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47307 (GCVE-0-2021-47307)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-08-05 08:47
VLAI
Title
cifs: prevent NULL deref in cifs_compose_mount_options()
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifs_compose_mount_options() The optional @ref parameter might contain an NULL node_name, so prevent dereferencing it in cifs_compose_mount_options(). Addresses-Coverity: 1476408 ("Explicit null dereferenced")
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 15:23 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2c55608f28444c3f33b10312881384c470ceed56 , < f7d1fa65e74263d11f90ddd33b4d4cd905a93759 (git)
Affected: 2c55608f28444c3f33b10312881384c470ceed56 , < e58c162789becede894d3e94c0ce6695a2ef5796 (git)
Affected: 2c55608f28444c3f33b10312881384c470ceed56 , < ae3d181f4e912f51af7776ea165f199b16fc165d (git)
Affected: 2c55608f28444c3f33b10312881384c470ceed56 , < 03313d1c3a2f086bb60920607ab79ac8f8578306 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.28
Unaffected: 0 , < 2.6.28 (semver)
Unaffected: 5.4.135 , ≤ 5.4.* (semver)
Unaffected: 5.10.53 , ≤ 5.10.* (semver)
Unaffected: 5.13.5 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:23:12.230114Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:23:18.690Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.503Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/cifs_dfs_ref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7d1fa65e74263d11f90ddd33b4d4cd905a93759",
              "status": "affected",
              "version": "2c55608f28444c3f33b10312881384c470ceed56",
              "versionType": "git"
            },
            {
              "lessThan": "e58c162789becede894d3e94c0ce6695a2ef5796",
              "status": "affected",
              "version": "2c55608f28444c3f33b10312881384c470ceed56",
              "versionType": "git"
            },
            {
              "lessThan": "ae3d181f4e912f51af7776ea165f199b16fc165d",
              "status": "affected",
              "version": "2c55608f28444c3f33b10312881384c470ceed56",
              "versionType": "git"
            },
            {
              "lessThan": "03313d1c3a2f086bb60920607ab79ac8f8578306",
              "status": "affected",
              "version": "2c55608f28444c3f33b10312881384c470ceed56",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/cifs_dfs_ref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "lessThan": "2.6.28",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.135",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.53",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.5",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL deref in cifs_compose_mount_options()\n\nThe optional @ref parameter might contain an NULL node_name, so\nprevent dereferencing it in cifs_compose_mount_options().\n\nAddresses-Coverity: 1476408 (\"Explicit null dereferenced\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The NULL deref is in CIFS client DFS referral handling (cifs_compose_mount_options via expand_dfs_referral/do_dfs_failover in cifs_mount), which processes attacker-controlled referral data from a remote SMB/DFS peer over the network, matching other malicious-server CIFS client scores.\nAC:L - Once the client mounts or chases DFS against a referral with a NULL node_name, cifs_build_devname(ref-\u003enode_name) deterministically faults with no race or other condition outside the attacker\u0027s influence.\nPR:N - The attacker is the malicious or compromised SMB/DFS server and needs no privileges or credentials on the victim host; referral processing runs as part of normal client mount/DFS handling.\nUI:N - In the worst reasonable deployment (fstab/autofs/cifsroot DFS mounts, or automounted DFS junctions under an already-mounted root that re-enter cifs_mount), mount-time referral expansion runs without an exploit-time interactive victim action.\nS:U - A kernel oops in the host CIFS client stays within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - This is a pure NULL pointer dereference of ref-\u003enode_name with no out-of-bounds read, UAF, or other information-disclosure primitive.\nI:N - The defect only crashes on NULL dereference in cifs_build_devname; it does not corrupt memory or provide a write or code-execution primitive.\nA:H - Dereferencing NULL node_name causes a kernel oops/panic during DFS mount option composition, fully denying availability and repeatable on subsequent mounts/referral chases."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:11.403Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759"
        },
        {
          "url": "https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d"
        },
        {
          "url": "https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306"
        }
      ],
      "title": "cifs: prevent NULL deref in cifs_compose_mount_options()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47307",
    "datePublished": "2024-05-21T14:35:26.667Z",
    "dateReserved": "2024-05-21T13:27:52.133Z",
    "dateUpdated": "2026-08-05T08:47:11.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47307",
      "date": "2026-09-15",
      "epss": "0.00684",
      "percentile": "0.5071"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.4.135\", \"matchCriteriaId\": \"A710000A-275C-4C73-8384-4FDF4204C682\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.53\", \"matchCriteriaId\": \"08E2D438-D50E-43C5-AF10-D62FE49B5815\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.13.5\", \"matchCriteriaId\": \"808DF8D9-4913-4CC7-B91F-B4146556B7ED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: prevent NULL deref in cifs_compose_mount_options()\\n\\nThe optional @ref parameter might contain an NULL node_name, so\\nprevent dereferencing it in cifs_compose_mount_options().\\n\\nAddresses-Coverity: 1476408 (\\\"Explicit null dereferenced\\\")\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: evita la eliminaci\\u00f3n de desreferencias NULL en cifs_compose_mount_options() El par\\u00e1metro @ref opcional puede contener un nombre de nodo NULL, por lo que se debe evitar eliminar la referencia a \\u00e9l en cifs_compose_mount_options(). Direcciones-Cobertura: 1476408 (\\\"Nulo expl\\u00edcito desreferenciado\\\")\"}]",
      "id": "CVE-2021-47307",
      "lastModified": "2024-12-26T18:44:19.590",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-21T15:15:18.320",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47307\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:18.320\",\"lastModified\":\"2026-08-04T10:16:57.277\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: prevent NULL deref in cifs_compose_mount_options()\\n\\nThe optional @ref parameter might contain an NULL node_name, so\\nprevent dereferencing it in cifs_compose_mount_options().\\n\\nAddresses-Coverity: 1476408 (\\\"Explicit null dereferenced\\\")\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: evita la eliminaci\u00f3n de desreferencias NULL en cifs_compose_mount_options() El par\u00e1metro @ref opcional puede contener un nombre de nodo NULL, por lo que se debe evitar eliminar la referencia a \u00e9l en cifs_compose_mount_options(). Direcciones-Cobertura: 1476408 (\\\"Nulo expl\u00edcito desreferenciado\\\")\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cifs/cifs_dfs_ref.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2c55608f28444c3f33b10312881384c470ceed56\",\"lessThan\":\"f7d1fa65e74263d11f90ddd33b4d4cd905a93759\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c55608f28444c3f33b10312881384c470ceed56\",\"lessThan\":\"e58c162789becede894d3e94c0ce6695a2ef5796\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c55608f28444c3f33b10312881384c470ceed56\",\"lessThan\":\"ae3d181f4e912f51af7776ea165f199b16fc165d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c55608f28444c3f33b10312881384c470ceed56\",\"lessThan\":\"03313d1c3a2f086bb60920607ab79ac8f8578306\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cifs/cifs_dfs_ref.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.28\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.28\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.135\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.53\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13.5\",\"lessThanOrEqual\":\"5.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T15:23:12.230114Z\",\"id\":\"CVE-2021-47307\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.135\",\"matchCriteriaId\":\"A710000A-275C-4C73-8384-4FDF4204C682\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.53\",\"matchCriteriaId\":\"08E2D438-D50E-43C5-AF10-D62FE49B5815\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.13.5\",\"matchCriteriaId\":\"808DF8D9-4913-4CC7-B91F-B4146556B7ED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:01:30+00:00",
      "cve": "CVE-2021-47307",
      "id": "CVE-2021-47307",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: prevent NULL deref in cifs_compose_mount_options()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47307.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T00:01:39Z",
      "cve": "CVE-2021-47307",
      "id": "CVE-2021-47307",
      "initial_release_date": "2024-05-23T03:04:51Z",
      "product_status:known_affected": "501",
      "product_status:known_not_affected": "182",
      "product_status:recommended": "219",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47307",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47307.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.503Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47307\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:23:12.230114Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:23:16.008Z\"}}], \"cna\": {\"title\": \"cifs: prevent NULL deref in cifs_compose_mount_options()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The NULL deref is in CIFS client DFS referral handling (cifs_compose_mount_options via expand_dfs_referral/do_dfs_failover in cifs_mount), which processes attacker-controlled referral data from a remote SMB/DFS peer over the network, matching other malicious-server CIFS client scores.\\nAC:L - Once the client mounts or chases DFS against a referral with a NULL node_name, cifs_build_devname(ref-\u003enode_name) deterministically faults with no race or other condition outside the attacker\u0027s influence.\\nPR:N - The attacker is the malicious or compromised SMB/DFS server and needs no privileges or credentials on the victim host; referral processing runs as part of normal client mount/DFS handling.\\nUI:N - In the worst reasonable deployment (fstab/autofs/cifsroot DFS mounts, or automounted DFS junctions under an already-mounted root that re-enter cifs_mount), mount-time referral expansion runs without an exploit-time interactive victim action.\\nS:U - A kernel oops in the host CIFS client stays within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\\nC:N - This is a pure NULL pointer dereference of ref-\u003enode_name with no out-of-bounds read, UAF, or other information-disclosure primitive.\\nI:N - The defect only crashes on NULL dereference in cifs_build_devname; it does not corrupt memory or provide a write or code-execution primitive.\\nA:H - Dereferencing NULL node_name causes a kernel oops/panic during DFS mount option composition, fully denying availability and repeatable on subsequent mounts/referral chases.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2c55608f28444c3f33b10312881384c470ceed56\", \"lessThan\": \"f7d1fa65e74263d11f90ddd33b4d4cd905a93759\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c55608f28444c3f33b10312881384c470ceed56\", \"lessThan\": \"e58c162789becede894d3e94c0ce6695a2ef5796\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c55608f28444c3f33b10312881384c470ceed56\", \"lessThan\": \"ae3d181f4e912f51af7776ea165f199b16fc165d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c55608f28444c3f33b10312881384c470ceed56\", \"lessThan\": \"03313d1c3a2f086bb60920607ab79ac8f8578306\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/cifs/cifs_dfs_ref.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.28\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.28\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.135\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.53\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.13.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/cifs/cifs_dfs_ref.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f7d1fa65e74263d11f90ddd33b4d4cd905a93759\"}, {\"url\": \"https://git.kernel.org/stable/c/e58c162789becede894d3e94c0ce6695a2ef5796\"}, {\"url\": \"https://git.kernel.org/stable/c/ae3d181f4e912f51af7776ea165f199b16fc165d\"}, {\"url\": \"https://git.kernel.org/stable/c/03313d1c3a2f086bb60920607ab79ac8f8578306\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: prevent NULL deref in cifs_compose_mount_options()\\n\\nThe optional @ref parameter might contain an NULL node_name, so\\nprevent dereferencing it in cifs_compose_mount_options().\\n\\nAddresses-Coverity: 1476408 (\\\"Explicit null dereferenced\\\")\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.135\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.53\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13.5\", \"versionStartIncluding\": \"2.6.28\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14\", \"versionStartIncluding\": \"2.6.28\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:11.403Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47307\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:11.403Z\", \"dateReserved\": \"2024-05-21T13:27:52.133Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:35:26.667Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.