CVE-2022-48828

NFSD: Fix ia_size underflow

State: Published
Severity: 9.1 Critical
Published: Jul 16, 2024
Updated: Oct 14, 2026
Reserved: Jul 16, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix ia_size underflow

iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle.

Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d2211e6e34d0755f35e2f8c22d81999fa81cfc71Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 38d02ba22e43b6fc7d291cf724bc6e3b7be6626bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8e0ecaf7a7e57b30284d6b3289cc436100fadc48Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before da22ca1ad548429d7822011c54cfe210718e0aa7Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e6faac3f58c7c4176b66f63def17a34232a17b0eAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.295 through 5.4.Not affected 5.10.220 through 5.10.Not affected 5.15.24 through 5.15.Not affected 5.16.10 through 5.16.Not affected 5.17 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d2211e6e34d0755f35e2f8c22d81999fa81cfc71Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 38d02ba22e43b6fc7d291cf724bc6e3b7be6626bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8e0ecaf7a7e57b30284d6b3289cc436100fadc48Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before da22ca1ad548429d7822011c54cfe210718e0aa7Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e6faac3f58c7c4176b66f63def17a34232a17b0eAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.295 through 5.4.*Not affected
5.10.220 through 5.10.*Not affected
5.15.24 through 5.15.*Not affected
5.16.10 through 5.16.*Not affected
5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.