In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix the behavior of READ near OFFSET_MAX
Dan Aloni reports:
Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to the RPC read layers") on the client, a read of 0xfff is aligned up to server rsize of 0x1000.
As a result, in a test where the server has a file of size 0x7fffffffffffffff, and the client tries to read from the offset 0x7ffffffffffff000, the read causes loff_t overflow in the server and it returns an NFS code of EINVAL to the client. The client as a result indefinitely retries the request.
The Linux NFS client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that status code for a READ.
Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This behavior appears to be consistent with Solaris NFS servers.
Note that NFSv3 and NFSv4 use u64 offset values on the wire. These must be converted to lofft internally before use -- an implicit type cast is not adequate for this purpose. Otherwise VFS checks against sb->smaxbytes do not work properly.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"function": "nfsd4_encode_read_plus",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-06f4a3a1",
"signature_version": "v1",
"digest": {
"length": 1394.0,
"function_hash": "219013799596775650466730151219896176719"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"function": "nfsd4_read",
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-0def7ed9",
"signature_version": "v1",
"digest": {
"length": 666.0,
"function_hash": "314896994889632196593267050036367697016"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-1713416d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192570754399136085395868428963794481716",
"296196625372186023613443070389924248546",
"52813131016101101030803009833160077558",
"151439670662155724254541331271849215138",
"295763730191138044262460395424222021987",
"169005517545982363055572518291499079080",
"216606590357396892690088766246293500617",
"268336046522470409331288388981168025595"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"function": "nfsd3_proc_read",
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-1c7e1d46",
"signature_version": "v1",
"digest": {
"length": 1014.0,
"function_hash": "125695164413591619019951501474823229730"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"function": "nfsd4_read",
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-27dbfdcf",
"signature_version": "v1",
"digest": {
"length": 666.0,
"function_hash": "314896994889632196593267050036367697016"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-3b177005",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182493345744078713592200462953100753000",
"2074362850585259926965100391340139839",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"232885252406867956488724365831316397756",
"203547353936712936850228747552347680287",
"169310614592135097912188757852929832744",
"219454927577789329559082600599783370089",
"112879784134582441801685324660222126083",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"292774069760018703627183500621599731548",
"80981161088890060555459149118979329552",
"186039225651606130283955711672912021759"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"function": "nfsd4_encode_read",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-3e70b3ce",
"signature_version": "v1",
"digest": {
"length": 984.0,
"function_hash": "182042839496332415829417119489343191235"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-465c7dcc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192570754399136085395868428963794481716",
"296196625372186023613443070389924248546",
"52813131016101101030803009833160077558",
"151439670662155724254541331271849215138",
"295763730191138044262460395424222021987",
"169005517545982363055572518291499079080",
"216606590357396892690088766246293500617",
"268336046522470409331288388981168025595"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-47a57746",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"152447102317946028983025231590393267585",
"2074362850585259926965100391340139839",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"232885252406867956488724365831316397756",
"203547353936712936850228747552347680287",
"169310614592135097912188757852929832744",
"219454927577789329559082600599783370089",
"112879784134582441801685324660222126083",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"292774069760018703627183500621599731548",
"80981161088890060555459149118979329552",
"186039225651606130283955711672912021759"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"function": "nfsd4_encode_read_plus",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-4c1d2c76",
"signature_version": "v1",
"digest": {
"length": 1394.0,
"function_hash": "219013799596775650466730151219896176719"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"function": "nfsd3_proc_read",
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-4e3cf083",
"signature_version": "v1",
"digest": {
"length": 1014.0,
"function_hash": "125695164413591619019951501474823229730"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"function": "nfsd4_read",
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-52943b55",
"signature_version": "v1",
"digest": {
"length": 666.0,
"function_hash": "314896994889632196593267050036367697016"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"function": "nfsd3_proc_read",
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-538f0e6a",
"signature_version": "v1",
"digest": {
"length": 1014.0,
"function_hash": "125695164413591619019951501474823229730"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"function": "nfsd4_encode_read",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-55e3652b",
"signature_version": "v1",
"digest": {
"length": 984.0,
"function_hash": "182042839496332415829417119489343191235"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-73bc07c2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"200048459605355933497168054887042077549",
"192380189936881699519154694526682521443",
"142975812489929082337405788470054548530",
"276894822547004879730869233170253300595",
"160893121130234837682176192843708577014",
"180551083242456292924607225321173539446",
"211960581563762014161857347918841473184"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-7e3647e2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"200048459605355933497168054887042077549",
"192380189936881699519154694526682521443",
"142975812489929082337405788470054548530",
"276894822547004879730869233170253300595",
"160893121130234837682176192843708577014",
"180551083242456292924607225321173539446",
"211960581563762014161857347918841473184"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-80cc0129",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192570754399136085395868428963794481716",
"296196625372186023613443070389924248546",
"52813131016101101030803009833160077558",
"151439670662155724254541331271849215138",
"295763730191138044262460395424222021987",
"169005517545982363055572518291499079080",
"216606590357396892690088766246293500617",
"268336046522470409331288388981168025595"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-848af0df",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"200048459605355933497168054887042077549",
"192380189936881699519154694526682521443",
"142975812489929082337405788470054548530",
"276894822547004879730869233170253300595",
"160893121130234837682176192843708577014",
"180551083242456292924607225321173539446",
"211960581563762014161857347918841473184"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-8e02bb5f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182493345744078713592200462953100753000",
"2074362850585259926965100391340139839",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"232885252406867956488724365831316397756",
"203547353936712936850228747552347680287",
"169310614592135097912188757852929832744",
"219454927577789329559082600599783370089",
"112879784134582441801685324660222126083",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"292774069760018703627183500621599731548",
"80981161088890060555459149118979329552",
"186039225651606130283955711672912021759"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-a4b9df1e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"200048459605355933497168054887042077549",
"192380189936881699519154694526682521443",
"142975812489929082337405788470054548530",
"276894822547004879730869233170253300595",
"160893121130234837682176192843708577014",
"180551083242456292924607225321173539446",
"211960581563762014161857347918841473184"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"function": "nfsd3_proc_read",
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-a883a554",
"signature_version": "v1",
"digest": {
"length": 1014.0,
"function_hash": "125695164413591619019951501474823229730"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b",
"target": {
"function": "nfsd4_encode_read",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-ab728224",
"signature_version": "v1",
"digest": {
"length": 984.0,
"function_hash": "182042839496332415829417119489343191235"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"function": "nfsd4_encode_read_plus",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-b1447260",
"signature_version": "v1",
"digest": {
"length": 1394.0,
"function_hash": "219013799596775650466730151219896176719"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-c626fc14",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182493345744078713592200462953100753000",
"2074362850585259926965100391340139839",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"232885252406867956488724365831316397756",
"203547353936712936850228747552347680287",
"169310614592135097912188757852929832744",
"219454927577789329559082600599783370089",
"112879784134582441801685324660222126083",
"224007063849747551308408399262724076148",
"224127007762486077297774625660861113489",
"292774069760018703627183500621599731548",
"80981161088890060555459149118979329552",
"186039225651606130283955711672912021759"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"function": "nfsd4_encode_read",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-dd7d7f07",
"signature_version": "v1",
"digest": {
"length": 987.0,
"function_hash": "73356214054464110791086610362449103242"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960",
"target": {
"function": "nfsd4_encode_read_plus",
"file": "fs/nfsd/nfs4xdr.c"
},
"deprecated": false,
"id": "CVE-2022-48827-e4b17211",
"signature_version": "v1",
"digest": {
"length": 1394.0,
"function_hash": "219013799596775650466730151219896176719"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0",
"target": {
"file": "fs/nfsd/nfs3proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-f8762408",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192570754399136085395868428963794481716",
"296196625372186023613443070389924248546",
"52813131016101101030803009833160077558",
"151439670662155724254541331271849215138",
"295763730191138044262460395424222021987",
"169005517545982363055572518291499079080",
"216606590357396892690088766246293500617",
"268336046522470409331288388981168025595"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9",
"target": {
"function": "nfsd4_read",
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"id": "CVE-2022-48827-ff7783cb",
"signature_version": "v1",
"digest": {
"length": 666.0,
"function_hash": "314896994889632196593267050036367697016"
},
"signature_type": "Function"
}
]