CVE-2022-4379

What it actually does

Use-after-free in __nfs42_ssc_open() allows an attacker to trigger a kernel crash or memory corruption via specially crafted NFSv4.2 requests, resulting in denial of service.

Why it matters to the business

Remote attackers can crash affected Linux systems that expose NFS shares, causing service outages for file-sharing workloads and requiring manual restarts or reboots.

How an attack unfolds

An attacker sends a sequence of NFSv4.2 operations that reach the flawed __nfs42_ssc_open path; the kernel frees an object while it is still referenced, leading to a subsequent dereference that panics the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 75333d48f92256a0dec91dbf07835e804fc411c0 or later; apply the vendor-supplied kernel package that includes this fix.

How to confirm the fix worked

Confirm the running kernel contains commit 75333d48f92256a0dec91dbf07835e804fc411c0 or verify the package version matches the fixed release; test that NFSv4.2 server-side copy operations no longer trigger crashes under load.

Typical attack path

1. Identify an exposed NFSv4.2 server
2. Craft and send a sequence of NFS operations that exercise the server-side copy open path
3. Trigger the use-after-free condition resulting in kernel panic or crash

How to detect it

Review kernel logs for oops, panic, or BUG messages referencing nfs4file.c or __nfs42_ssc_open; correlate with inbound NFSv4.2 traffic from untrusted sources around the time of the crash.

What your security team should do

• Apply the kernel update containing commit 75333d48f92256a0dec91dbf07835e804fc411c0 as soon as possible on all systems exposing NFS
• Restrict NFS exposure to trusted networks until patches are deployed
• Monitor for kernel oops or panic events related to nfs4file.c