CVE-2022-48828: NFSD: Fix ia_size underflow
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix iasize underflow
iattr::iasize is a lofft, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle.
Currently decodefattr4() dumps a full u64 value into iasize. If that value happens to be larger than S64MAX, then iasize underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsdsetattr().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.220 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.16.10 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.17 - Configuration
Apply the kernel resolution for CVE described as “NFSD: Fix ia_size underflow” by catching the underflow in the common code path nfsd_setattr(), since iattr::ia_size is a loff_t (signed 64-bit) while NFSv3/NFSv4 file size is an unsigned 64-bit type.
Linux kernel nfsd nfsd_setattr() iattr::ia_size handling = Add an underflow check for ia_size when the NFS client-supplied file size exceeds S64_MAX (treat as invalid instead of allowing signed underflow)
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48828?
CVE-2022-48828 has a medium severity rating due to the potential for file size manipulation in NFS clients.
How do I fix CVE-2022-48828?
To fix CVE-2022-48828, update the Linux kernel to versions 5.10.220, 5.15.24, 5.16.10, or 5.17.
What systems are affected by CVE-2022-48828?
CVE-2022-48828 affects NFS clients using vulnerable versions of the Linux kernel that do not handle file size correctly.
What kind of vulnerability is CVE-2022-48828?
CVE-2022-48828 is a vulnerability related to an ia_size underflow in the Linux kernel's handling of NFS file sizes.
Is there a workaround for CVE-2022-48828?
There are no known workarounds for CVE-2022-48828, so upgrading to a patched kernel version is recommended.