CVE-2022-50302

A flaw was found in the Linux kernel's lockd component, which handles file locking. A local user could exploit this vulnerability by interacting with re-exported NFSv3 (Network File System version 3) shares. This could cause the kernel to crash, leading to a Denial of Service (DoS) for the system.

A moderate severity flaw was found in the Linux kernel's lockd file-locking handling. When a file on a re-exported NFSv3 share is unlocked, the kernel can pass a struct file_lock that is not fully initialized (a NULL fl_file field) to vfs_lock_file(), causing a kernel Oops and crash, resulting in a denial of service. Exploitation requires local user interaction with a system that re-exports NFSv3 file systems, which is why Red Hat rates this flaw as moderate (CVSS 5.5, AV:L/AC:L/PR:L) rather than the important severity assigned in the upstream CVE record, whose network-scoped vector does not reflect the local access and privilege requirements of this issue. This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6, 7, 8, and 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 9 streams the fix has been deferred: because the flaw is a local, privilege-gated denial of service limited to NFSv3 re-export configurations, it will be addressed in a future update rather than an immediate z-stream fix, and the residual risk is a kernel crash (system denial of service) on systems that re-export NFSv3 file systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw is only exposed on systems that re-export NFSv3 file systems and serve file locking on them. As a workaround, avoid NFSv3 re-exports: configure the NFS server to serve only NFSv4, for example by disabling NFSv3 with vers3=n in the [nfsd] section of /etc/nfs.conf and restarting the nfs-server service, or disable the NFS server entirely (systemctl disable --now nfs-server) if NFS services are not required. Restricting or disabling NFSv3 may impact clients that depend on NFSv3 access.