In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix the behavior of READ near OFFSET_MAX
Dan Aloni reports:
Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to the RPC read layers") on the client, a read of 0xfff is aligned up to server rsize of 0x1000.
As a result, in a test where the server has a file of size 0x7fffffffffffffff, and the client tries to read from the offset 0x7ffffffffffff000, the read causes loff_t overflow in the server and it returns an NFS code of EINVAL to the client. The client as a result indefinitely retries the request.
The Linux NFS client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that status code for a READ.
Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This behavior appears to be consistent with Solaris NFS servers.
Note that NFSv3 and NFSv4 use u64 offset values on the wire. These must be converted to lofft internally before use -- an implicit type cast is not adequate for this purpose. Otherwise VFS checks against sb->smaxbytes do not work properly.
[ { "signature_type": "Function", "id": "CVE-2022-48827-06f4a3a1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "function": "nfsd4_encode_read_plus", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "219013799596775650466730151219896176719", "length": 1394.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-0def7ed9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "function": "nfsd4_read", "file": "fs/nfsd/nfs4proc.c" }, "digest": { "function_hash": "314896994889632196593267050036367697016", "length": 666.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-1713416d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs3proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "192570754399136085395868428963794481716", "296196625372186023613443070389924248546", "52813131016101101030803009833160077558", "151439670662155724254541331271849215138", "295763730191138044262460395424222021987", "169005517545982363055572518291499079080", "216606590357396892690088766246293500617", "268336046522470409331288388981168025595" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-1c7e1d46", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "function": "nfsd3_proc_read", "file": "fs/nfsd/nfs3proc.c" }, "digest": { "function_hash": "125695164413591619019951501474823229730", "length": 1014.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-27dbfdcf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "function": "nfsd4_read", "file": "fs/nfsd/nfs4proc.c" }, "digest": { "function_hash": "314896994889632196593267050036367697016", "length": 666.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-3b177005", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "182493345744078713592200462953100753000", "2074362850585259926965100391340139839", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "232885252406867956488724365831316397756", "203547353936712936850228747552347680287", "169310614592135097912188757852929832744", "219454927577789329559082600599783370089", "112879784134582441801685324660222126083", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "292774069760018703627183500621599731548", "80981161088890060555459149118979329552", "186039225651606130283955711672912021759" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-3e70b3ce", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "function": "nfsd4_encode_read", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "182042839496332415829417119489343191235", "length": 984.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-465c7dcc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs3proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "192570754399136085395868428963794481716", "296196625372186023613443070389924248546", "52813131016101101030803009833160077558", "151439670662155724254541331271849215138", "295763730191138044262460395424222021987", "169005517545982363055572518291499079080", "216606590357396892690088766246293500617", "268336046522470409331288388981168025595" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-47a57746", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "152447102317946028983025231590393267585", "2074362850585259926965100391340139839", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "232885252406867956488724365831316397756", "203547353936712936850228747552347680287", "169310614592135097912188757852929832744", "219454927577789329559082600599783370089", "112879784134582441801685324660222126083", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "292774069760018703627183500621599731548", "80981161088890060555459149118979329552", "186039225651606130283955711672912021759" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-4c1d2c76", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "function": "nfsd4_encode_read_plus", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "219013799596775650466730151219896176719", "length": 1394.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-4e3cf083", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "function": "nfsd3_proc_read", "file": "fs/nfsd/nfs3proc.c" }, "digest": { "function_hash": "125695164413591619019951501474823229730", "length": 1014.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-52943b55", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "function": "nfsd4_read", "file": "fs/nfsd/nfs4proc.c" }, "digest": { "function_hash": "314896994889632196593267050036367697016", "length": 666.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-538f0e6a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "function": "nfsd3_proc_read", "file": "fs/nfsd/nfs3proc.c" }, "digest": { "function_hash": "125695164413591619019951501474823229730", "length": 1014.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-55e3652b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "function": "nfsd4_encode_read", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "182042839496332415829417119489343191235", "length": 984.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-73bc07c2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "200048459605355933497168054887042077549", "192380189936881699519154694526682521443", "142975812489929082337405788470054548530", "276894822547004879730869233170253300595", "160893121130234837682176192843708577014", "180551083242456292924607225321173539446", "211960581563762014161857347918841473184" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-7e3647e2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "200048459605355933497168054887042077549", "192380189936881699519154694526682521443", "142975812489929082337405788470054548530", "276894822547004879730869233170253300595", "160893121130234837682176192843708577014", "180551083242456292924607225321173539446", "211960581563762014161857347918841473184" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-80cc0129", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs3proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "192570754399136085395868428963794481716", "296196625372186023613443070389924248546", "52813131016101101030803009833160077558", "151439670662155724254541331271849215138", "295763730191138044262460395424222021987", "169005517545982363055572518291499079080", "216606590357396892690088766246293500617", "268336046522470409331288388981168025595" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-848af0df", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "200048459605355933497168054887042077549", "192380189936881699519154694526682521443", "142975812489929082337405788470054548530", "276894822547004879730869233170253300595", "160893121130234837682176192843708577014", "180551083242456292924607225321173539446", "211960581563762014161857347918841473184" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-8e02bb5f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "182493345744078713592200462953100753000", "2074362850585259926965100391340139839", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "232885252406867956488724365831316397756", "203547353936712936850228747552347680287", "169310614592135097912188757852929832744", "219454927577789329559082600599783370089", "112879784134582441801685324660222126083", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "292774069760018703627183500621599731548", "80981161088890060555459149118979329552", "186039225651606130283955711672912021759" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-a4b9df1e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "200048459605355933497168054887042077549", "192380189936881699519154694526682521443", "142975812489929082337405788470054548530", "276894822547004879730869233170253300595", "160893121130234837682176192843708577014", "180551083242456292924607225321173539446", "211960581563762014161857347918841473184" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-a883a554", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "function": "nfsd3_proc_read", "file": "fs/nfsd/nfs3proc.c" }, "digest": { "function_hash": "125695164413591619019951501474823229730", "length": 1014.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-ab728224", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44502aca8e02ab32d6b0eb52e006a5ec9402719b", "signature_version": "v1", "target": { "function": "nfsd4_encode_read", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "182042839496332415829417119489343191235", "length": 984.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-b1447260", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "function": "nfsd4_encode_read_plus", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "219013799596775650466730151219896176719", "length": 1394.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-c626fc14", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "182493345744078713592200462953100753000", "2074362850585259926965100391340139839", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "232885252406867956488724365831316397756", "203547353936712936850228747552347680287", "169310614592135097912188757852929832744", "219454927577789329559082600599783370089", "112879784134582441801685324660222126083", "224007063849747551308408399262724076148", "224127007762486077297774625660861113489", "292774069760018703627183500621599731548", "80981161088890060555459149118979329552", "186039225651606130283955711672912021759" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-dd7d7f07", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "function": "nfsd4_encode_read", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "73356214054464110791086610362449103242", "length": 987.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-e4b17211", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960", "signature_version": "v1", "target": { "function": "nfsd4_encode_read_plus", "file": "fs/nfsd/nfs4xdr.c" }, "digest": { "function_hash": "219013799596775650466730151219896176719", "length": 1394.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2022-48827-f8762408", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eff5c4277146a78b4fb8c9b668dd64542c41b0", "signature_version": "v1", "target": { "file": "fs/nfsd/nfs3proc.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "192570754399136085395868428963794481716", "296196625372186023613443070389924248546", "52813131016101101030803009833160077558", "151439670662155724254541331271849215138", "295763730191138044262460395424222021987", "169005517545982363055572518291499079080", "216606590357396892690088766246293500617", "268336046522470409331288388981168025595" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2022-48827-ff7783cb", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1726a39b0879acfb490b22dca643f26f4f907da9", "signature_version": "v1", "target": { "function": "nfsd4_read", "file": "fs/nfsd/nfs4proc.c" }, "digest": { "function_hash": "314896994889632196593267050036367697016", "length": 666.0 }, "deprecated": false } ]