CVE-2022-49362

A flaw was found in the Linux kernel's Network File System daemon (NFSD). A local user could exploit this vulnerability to cause a Denial of Service (DoS) or potentially execute arbitrary code. The issue stems from a use-after-free condition in the file caching mechanism, where a file structure is dereferenced immediately after being released.

An Important severity use-after-free flaw was found in the Linux kernel's Network File System daemon (NFSD) file-caching mechanism, which is part of the Red Hat Enterprise Linux kernel. In nfsd_file_put(), the nfsd_file structure can be freed by nfsd_file_put_noref(), and the code then dereferences that structure immediately after it has been freed. A local user able to run code on the system could exploit this use-after-free to cause a denial of service or, potentially, execute arbitrary code. Red Hat rates this flaw Important, with a CVSS 3.1 score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), because exploitation requires local access and local user privileges. This differs from the CVE.org score of 9.8, which assumes a network attack vector that is not supported by the technical nature of this flaw. Most Red Hat products in this flaw record are not affected, including Red Hat Enterprise Linux 6, 7, 8, and 10 update streams and Red Hat In-Vehicle OS, with the recorded justifications citing that the vulnerable code is not present. The remaining Red Hat Enterprise Linux 9.0.z entries for the kernel, kernel-rt, and kpatch components are delegated to the Red Hat Enterprise Linux kernel maintainers, whose analysis determined that the vulnerable code is not present in those builds and closed the associated trackers as not a bug.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.