CVE-2022-49418: NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

Q: Which systems are exposed to this issue?

Systems running the Linux kernel with NFSv4 functionality involved in referral lookups are implicated. The provided data does not identify affected kernel version ranges or distribution package versions.

Q: What is required to trigger the vulnerability?

The failure occurs during an NFSv4 referral lookup and can be reached through pathname lookup activity, with the example crash occurring while running "ls". The listed vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

Q: How can administrators recognize a possible occurrence?

Affected systems may crash or panic during NFS pathname resolution. The supplied stack trace includes nfs_lookup, __lookup_slow, walk_component, path_lookupat, and filename_lookup, and the issue concerns freeing an uninitialized nfs4_label.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Fix free of uninitialized nfs4label on referral lookup.

Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:

PID: 790 TASK: ffff88811b43c000 CPU: 0 COMMAND: "ls" #0 [ffffc90000857920] panic at ffffffff81b9bfde #1 [ffffc900008579c0] dotrap at ffffffff81023a9b #2 [ffffc90000857a10] doerrortrap at ffffffff81023b78 #3 [ffffc90000857a58] excstacksegment at ffffffff81be1f45 #4 [ffffc90000857a80] asmexcstacksegment at ffffffff81c009de #5 [ffffc90000857b08] nfslookup at ffffffffa0302322 [nfs] #6 [ffffc90000857b70] lookupslow at ffffffff813a4a5f #7 [ffffc90000857c60] walkcomponent at ffffffff813a86c4 #8 [ffffc90000857cb8] pathlookupat at ffffffff813a9553 #9 [ffffc90000857cf0] filenamelookup at ffffffff813ab86b

Affected Software

6 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=5.16<5.18.3

debian/linux<5.18.5-1

5.18.5-1

debian/linux<5.18.5-1

5.18.5-1

debian/linux<5.18.5-1

5.18.5-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.18.5-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1

Event History

Feb 26, 2025

CVE Published

via MITRE·02:12 AM

Data Sourced

via MITRE·02:12 AM

DescriptionSeverity

Data Sourced

via NVD·07:01 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·07:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the Linux kernel with NFSv4 functionality involved in referral lookups are implicated. The provided data does not identify affected kernel version ranges or distribution package versions.

What is required to trigger the vulnerability?

The failure occurs during an NFSv4 referral lookup and can be reached through pathname lookup activity, with the example crash occurring while running "ls". The listed vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

How can administrators recognize a possible occurrence?

Affected systems may crash or panic during NFS pathname resolution. The supplied stack trace includes nfs_lookup, __lookup_slow, walk_component, path_lookupat, and filename_lookup, and the issue concerns freeing an uninitialized nfs4_label.

CVE-2022-49418: NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the vulnerability?

How can administrators recognize a possible occurrence?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the vulnerability?

How can administrators recognize a possible occurrence?