Executive brief
A vulnerability exists in the Linux kernel's Network File System (NFS) server component, which is used to share files across a network. An attacker can send a specially crafted network message to crash the server, leading to a denial-of-service condition. This could disrupt business operations by making shared files and storage systems unavailable to users and applications.
Technical details
A buffer overflow vulnerability exists in the Linux kernel NFSD (NFS server) implementation due to incorrect calculation of buffer sizes when handling Remote Procedure Call (RPC) messages. NFSD shares receive and send buffers in a single array of pages; an attacker can send a specially crafted RPC message over TCP with trailing 'garbage' data that is technically compliant with the specification but causes the send buffer to shrink unexpectedly. When the server attempts to construct a reply, it writes beyond the allocated page boundaries because it assumes a full-sized buffer is available. This can be triggered remotely without authentication (depending on export configuration) and results in a kernel panic or denial of service. The issue was addressed in Linux kernel versions 5.19.17 and 6.0.2.
Affected products
- Linux Linux Kernel versions before 5.19.17, versions 6.0.x before 6.0.2
- NetApp H300S Firmware
- NetApp H410C Firmware
- NetApp H410S Firmware
- NetApp H500S Firmware
- NetApp H700S Firmware
- NetApp Active IQ Unified Manager for VMware vSphere
- Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Timeline
- 2022-10-03: patched: Fix committed to Linux kernel source
- 2022-11-04: disclosed: Initial NVD publication
- 2022-12-15: advisory: NetApp advisory published
- 2024-04-09: advisory: Siemens advisory published
References
- http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f90497a16e434c2211c66e3de8e77b17868382b8
- https://security.netapp.com/advisory/ntap-20221215-0006/
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html