CVE-2022-50487

Red Hat statement

NFSD optimizes memory usage by sharing the same page array for both receiving RPC calls and sending replies, since operations typically don't need large buffers simultaneously. When an RPC call arrives, the response buffer size is calculated based on remaining pages after accounting for the received data. A malicious client can send a correctly-formed but deliberately oversized RPC record containing a small actual RPC call. The NFSD thread processes this normally, but the response buffer (rq_res) is now constrained. When constructing a READDIR reply, which can be quite large, the encoder writes past the truncated buffer boundary into adjacent kernel memory.