CVE-2022-43945

2022-11-0400:00:00

ubuntu.com

linux

nfsd

buffer overflow

tcp

rpc

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

52.6%

JSON

The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2
are vulnerable to buffer overflow. NFSD tracks the number of pages held by
each NFSD thread by combining the receive and send buffers of a remote
procedure call (RPC) into a single array of pages. A client can force the
send buffer to shrink by sending an RPC message over TCP with garbage data
added at the end of the message. The RPC message with garbage data is still
correctly formed according to the specification and is passed forward to
handlers. Vulnerable code in NFSD is not expecting the oversized request
and writes beyond the allocated buffer space.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-202.213UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-137.154UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-56.62UNKNOWN
ubuntu22.10noarchlinux< 5.19.0-26.27UNKNOWN
ubuntu23.04noarchlinux< 6.1.0-16.16UNKNOWN
ubuntu14.04noarchlinux< anyUNKNOWN
ubuntu16.04noarchlinux< 4.4.0-236.270UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1148.160UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1094.102UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1026.30UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-202.213	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-137.154	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-56.62	UNKNOWN
ubuntu	22.10	noarch	linux	< 5.19.0-26.27	UNKNOWN
ubuntu	23.04	noarch	linux	< 6.1.0-16.16	UNKNOWN
ubuntu	14.04	noarch	linux	< any	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-236.270	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1148.160	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1094.102	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1026.30	UNKNOWN