An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the ODIRECTORY flag, and tries to open a regular file, nfsatomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
[
{
"id": "CVE-2022-24448-666c2b73",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229051601866531394102386754683488172454",
"149446250467402509312707843855750368701",
"76002126802954665098234822408253399142",
"23759034888035224348536589718138705472"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ac795161c93699d600db16c1a8cc23a65a1eceaf",
"signature_type": "Line",
"target": {
"file": "fs/nfs/dir.c"
}
},
{
"id": "CVE-2022-24448-914380f2",
"signature_version": "v1",
"digest": {
"function_hash": "179690038698363381102057301296388227716",
"length": 2472.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ac795161c93699d600db16c1a8cc23a65a1eceaf",
"signature_type": "Function",
"target": {
"file": "fs/nfs/dir.c",
"function": "nfs_atomic_open"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24448.json"
[
{
"id": "CVE-2022-24448-10f31121",
"signature_version": "v1",
"digest": {
"function_hash": "260933519447651611387834204668646832034",
"length": 1251.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
"signature_type": "Function",
"target": {
"file": "fs/nfs/nfs4file.c",
"function": "nfs4_file_open"
}
},
{
"id": "CVE-2022-24448-23a6b67d",
"signature_version": "v1",
"digest": {
"function_hash": "179690038698363381102057301296388227716",
"length": 2472.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf",
"signature_type": "Function",
"target": {
"file": "fs/nfs/dir.c",
"function": "nfs_atomic_open"
}
},
{
"id": "CVE-2022-24448-3df3e648",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"211118484474848962087532402965396199735",
"81130625213328821218584708084281440041",
"302412427299261031235399371141528603932",
"201973423859563026478610090601215747920"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
"signature_type": "Line",
"target": {
"file": "fs/nfs/inode.c"
}
},
{
"id": "CVE-2022-24448-72996d18",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229051601866531394102386754683488172454",
"149446250467402509312707843855750368701",
"76002126802954665098234822408253399142",
"23759034888035224348536589718138705472"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/ac795161c93699d600db16c1a8cc23a65a1eceaf",
"signature_type": "Line",
"target": {
"file": "fs/nfs/dir.c"
}
},
{
"id": "CVE-2022-24448-cec8b97c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"131694442210934197847724267282108448637",
"66486244452043829823369127922251272797",
"180562991044132845481427610037404943822",
"121993712980436899453406106571431142151"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a",
"signature_type": "Line",
"target": {
"file": "fs/nfs/nfs4file.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24448.json"