Linux Kernel up to 5.10.219/5.15.23/5.16.9 NFSD decode_fattr4 data authenticity

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.10.219/5.15.23/5.16.9. It has been declared as problematic. This vulnerability affects the function decode_fattr4 of the component NFSD. Executing a manipulation can lead to data authenticity. This vulnerability appears as CVE-2022-48828. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.10.219/5.15.23/5.16.9. This vulnerability affects the function decode_fattr4 of the component NFSD. The manipulation with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2022-48828 since 07/16/2024. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 210643 (EulerOS 2.0 SP10 : kernel (EulerOS-SA-2024-2888)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.10.220, 5.15.24 or 5.16.10 eliminates this vulnerability. Applying the patch 38d02ba22e43/8e0ecaf7a7e5/da22ca1ad548/e6faac3f58c7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (210643). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.10.219
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion