CVE-2022-48829
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In the Linux kernel, in NFSD, the handling of large file sizes in NFSv3 SETATTR/CREATE procedures was fixed by removing the min_t() check to avoid unexpected truncation.
Risk Assessment
Incorrect truncation of file size could lead to data inconsistency or unexpected behavior of the NFS server.
Recommendation
Install the updated Linux kernel with the fix for NFSD.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value. Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3(). Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large.