VYPR
← All advisories
High severity7.1NVD Advisory· Published Jul 16, 2024· Updated May 12, 2026

CVE-2022-48827

CVE-2022-48827

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix the behavior of READ near OFFSET_MAX

Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an NFS code of EINVAL to the client. The client as > a result indefinitely retries the request.

The Linux NFS client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that status code for a READ.

Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This behavior appears to be consistent with Solaris NFS servers.

Note that NFSv3 and NFSv4 use u64 offset values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In Linux NFSD, a READ near OFFSET_MAX causes loff_t overflow and returns EINVAL, leading to indefinite client retries instead of a short result with EOF.

The Linux kernel NFS server (NFSD) contained a vulnerability triggered when a client performs a READ request near the maximum file offset (OFFSET_MAX). The official description states that after a client-side alignment change, a read from offset 0x7ffffffffffff000 of a file of size 0x7fffffffffffffff causes a loff_t overflow on the server. The server then returns NFS?ERR_INVAL, which the Linux NFS client does not handle properly, resulting in indefinite retries [1][2].

Root

Cause

The root cause is an implicit type cast issue: NFSv3 and NFSv4 use u64 offset values on the wire, which must be explicitly converted to loff_t before use. Without proper conversion, VFS checks against sb->s_maxbytes do not work correctly, and the overflow leads to an invalid error response [1]. The attack surface is remote, though an attacker must have legitimate access to an NFS share and be able to mount the filesystem with a client that aligns reads (e.g., due to the commit 8cfb9015280d). No special privilege beyond file read access is needed.

Impact

An attacker who can trigger this condition can cause a denial-of-service condition: the NFS client retries the request indefinitely, consuming network and server resources. Depending on the environment, this could lead to service disruption for other clients. The Siemens advisory notes a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) for the associated CWE-125 (Out-of-bounds Read), but the primary impact is denial of service rather than information disclosure [2].

Mitigation

The fix changes the server behavior: instead of returning NFS?ERR_INVAL, out-of-range READ requests succeed and return a short result with the EOF flag set. This prevents the client from retrying. The upstream Linux kernel patches have been available since February 2022 (commit 0cb4d23ae08c, among others). Siemens lists the vulnerability in their SSA-265688 advisory, affecting the SIMATIC S7-1500 TM MFP GNU/Linux subsystem, where all versions are affected; users should apply updates provided by Siemens [1].

References
  1. SSA-265688
  2. SSA-355557

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

166

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.