CVE-2022-43945
kernel: nfsd buffer overflow by RPC message over TCP with garbage data
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 3, 2022
Updated · June 28, 2026
Description
A buffer overflow flaw was found in the Linux kernel nfsd (network file system) subsystem. The way a user sends RPC over TCP with excess data added at the end of the message could allow a remote user to starve the resources, causing a denial of service.
Statement
Affected versions of the Red Hat Enterprise Linux are 8.7 and higher, because starting from the 8.7 the affected source code introduced with the errata RHSA-2022:7683.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 · Allocation of Resources Without Limits or Throttling