CVE-2022-43945High· 7.5▾ TwilightThe Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RP…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 4.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
22%
The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
linux_kernel < 5.19.17linux_kernel >= 6.0, < 6.0.2active_iq_unified_managerh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareh410c_firmwareUpgrade past the affected range:
linux_kernel 6.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-3338Medium· 6.5A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol
CVE-2022-36946High· 7.5nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_p…
CVE-2022-36879Medium· 5.5An issue was discovered in the Linux kernel through 5.18.14
CVE-2022-3649Low· 3.1A vulnerability was found in Linux Kernel
CVE-2021-32292Critical· 9.8An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726
CVE-2021-38202High· 7.5fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.