CVE-2022-50487

A buffer management flaw was found in the Linux kernel's NFS server implementation in the NFSv3 READDIR operation handling. A remote client can trigger this issue by crafting an RPC call with an oversized RPC record header, which forces the server to shrink its response buffer allocation. This causes the READDIR response construction to write beyond the available buffer space, resulting in a send buffer overflow that leads to memory corruption, denial of service via crash, or potential data integrity issues.

NFSD optimizes memory usage by sharing the same page array for both receiving RPC calls and sending replies, since operations typically don't need large buffers simultaneously. When an RPC call arrives, the response buffer size is calculated based on remaining pages after accounting for the received data. A malicious client can send a correctly-formed but deliberately oversized RPC record containing a small actual RPC call. The NFSD thread processes this normally, but the response buffer (rq_res) is now constrained. When constructing a READDIR reply, which can be quite large, the encoder writes past the truncated buffer boundary into adjacent kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.