CVE-2022-48829
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value. Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3(). Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large.
How to fix
- linux linux_kernel5.4.295, 5.10.220, 5.15.24, 5.16.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 5.4.295, 5.5 ≤ v < 5.10.220, 5.11 ≤ v < 5.15.24, 5.16 ≤ v < 5.16.10, 5.17 | 5.4.295, 5.10.220, 5.15.24, 5.16.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.