Junglewise Threat Intelligence

CVE-2022-48827: Linux Kernel NFSD integer overflow in READ near OFFSET_MAX

CVE-2022-48827 · Severity: high · CVSS 7.1 · Published 2024-07-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a user to cause a system hang or potentially access unauthorized data. When a client attempts to read data near the maximum possible file size, the server may experience an internal overflow error. This causes the client to enter an infinite loop of retrying the request, which can disrupt operations and impact system availability.

Technical details

An integer overflow vulnerability exists in the Linux kernel's NFSD implementation (NFSv3 and NFSv4) when processing READ requests with offsets near OFFSET_MAX. The root cause is an inadequate conversion of u64 wire offset values to internal loff_t types, which bypasses VFS checks against sb->s_maxbytes. When a client sends a read request that, when aligned, exceeds the maximum offset, the server returns EINVAL. Because the Linux NFS client does not handle this error code for READ operations, it enters an infinite retry loop. An attacker could exploit this to cause a denial-of-service (DoS) or potentially trigger an out-of-bounds read (CWE-125). Patches have been released for various stable kernel branches to ensure offsets are properly capped and return short results with an EOF flag instead of an error.

Affected products

  • Linux Linux Kernel versions up to 5.10.220, 5.11 to 5.15.24, 5.16 to 5.16.10

Timeline

  • 2022-02-04: patched: Initial fix authored by Chuck Lever
  • 2024-07-16: disclosed: CVE-2022-48827 published

References

Related threats