PT-2022-6187 · Linux+9 · Linux Kernel+9
Published
2022-09-26
·
Updated
2025-12-04
·
CVE-2022-43945
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.19.17 and 6.0.2
Description
The issue is related to a buffer overflow in the Linux kernel NFSD implementation. It occurs because NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. This can lead to a denial of service.
Recommendations
For versions prior to 5.19.17, update to version 5.19.17 or later.
For versions prior to 6.0.2, update to version 6.0.2 or later.
As a temporary workaround, consider restricting access to the NFSD implementation until a patch is available.
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Rocky Linux
Suse
Ubuntu