CoreCVE
Back

CRITICAL

NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes

Published Jul 16, 2024

Description

iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger than s64_max without corrupting the value.

Silently capping the value results in storing a different value than the client passed in which is unexpected behavior, so remove the min_t() check in decode_sattr3().

Note that RFC 1813 permits only the WRITE procedure to return NFS3ERR_FBIG. We believe that NFSv3 reference implementations also return NFS3ERR_FBIG when ia_size is too large.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-253

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Jul 16, 2024
Updated Aug 5, 2026
Reserved Jul 16, 2024
Link CVE-2022-48829
CISA Vulnrichment
Updated Sep 10, 2024
NVD
Status Modified
Modified Aug 4, 2026
Link CVE-2022-48829
Red Hat
Severity Moderate
Public date Jul 16, 2024
Links CVE-2022-48829 - Bugzilla