CVE-2022-43945

What it actually does

Buffer overflow in Linux kernel NFSD when processing RPC messages over TCP that include garbage data, causing writes beyond allocated page buffers combined from receive and send arrays.

Why it matters to the business

Denial of service against NFS servers on unpatched Linux systems, disrupting file sharing and storage access with moderate exploit likelihood indicated by EPSS score around 0.22 and no known ransomware use.

How an attack unfolds

An attacker sends a correctly formed but oversized RPC message containing garbage data at the end over TCP, forcing the send buffer to shrink; NFSD handlers then write beyond the allocated buffer space leading to a crash.

How to fix it

Update Linux kernel to versions 5.19.17, 6.0.2 or later; apply the fix from commit f90497a16e434c2211c66e3de8e77b17868382b8 in the upstream repository.

How to confirm the fix worked

Confirm kernel version is at or above the fixed releases and test NFS RPC handling with malformed messages to ensure no buffer overflow occurs.

Typical attack path

1. Identify exposed NFS services on target Linux systems
2. Craft and send TCP RPC message with appended garbage data to trigger buffer miscalculation
3. Trigger kernel panic or service crash via oversized request handling in NFSD

How to detect it

Review kernel logs for NFSD related buffer or page allocation errors and unusual TCP traffic patterns targeting NFS ports; correlate with high volume RPC requests from untrusted sources.

What your security team should do

• Prioritize kernel updates on all systems exposing NFS services due to network-reachable impact
• Monitor for kernel crashes or NFSD related panics in system logs
• Restrict NFS access to trusted networks where possible until patched