CVE-2022-50410
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In the Linux kernel, NFSD has a send buffer overflow vulnerability in NFSv2 READ. A client can send an excessively large RPC record, shrinking the reply buffer and preventing full payload construction, potentially leading to overflow.
Risk Assessment
A remote attacker can cause NFS service crash or potentially execute code in the kernel, threatening system integrity.
Recommendation
Apply the Linux kernel patch that fixes this issue (NFSD commit).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.