CVE-2022-50345

kernel: NFSD: Protect against send buffer overflow in NFSv3 READ

View on CVE.org
Published Sep 16, 2025 CVSS 3.1 · 7.0 High EPSS n/a KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Analysis

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-55617 This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
History
Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv3 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Title NFSD: Protect against send buffer overflow in NFSv3 READ kernel: NFSD: Protect against send buffer overflow in NFSv3 READ
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv3 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.
Title NFSD: Protect against send buffer overflow in NFSv3 READ
References
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
Linux
Published
Updated
Sep 29, 2025, 6:26 PM
Reserved
Sep 16, 2025, 4:03 PM

View source JSON

No data.

Status
Rejected
Published
Sep 16, 2025, 5:15 PM
Modified
Oct 18, 2026, 1:10 AM

View source JSON

Severity
Moderate
Public date
Sep 16, 2025, 12:00 AM

View source Bugzilla JSON

No data.