CVE-2022-48827

What it actually does

Out-of-range NFS READ requests near OFFSET_MAX cause implicit type cast of u64 offset to loff_t resulting in overflow; server returns NFSERR_INVAL instead of short read with EOF, triggering indefinite client retry loops.

Why it matters to the business

NFS file servers handling very large files can become unresponsive to legitimate clients, leading to application hangs, stalled backups, and degraded file-sharing services; widespread kernel packages across Debian and Ubuntu increase exposure surface.

How an attack unfolds

An attacker with local access or control of an NFS client issues a READ request at offset 0x7ffffffffffff000 against a file sized near 0x7fffffffffffffff; the server overflows the offset calculation, returns EINVAL, and the unhandled error causes the client to loop indefinitely, denying service.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.103-1 (Debian 11), 5.16.7-1 (Debian 12/13), 5.4.0-9.12 or 5.4.0-1005.5/1006.6 (Ubuntu 20.04 and derivatives including aws/azure variants), or 5.15.0-1014.18~20.04.1 (linux-aws-5.15). Reboot after package installation and verify NFS service functionality.

How to confirm the fix worked

Confirm kernel version matches or exceeds listed fixed releases; test NFS READ operations at offsets approaching 0x7ffffffffffff000 on large files and verify short-read-plus-EOF behavior instead of EINVAL; monitor for absence of retry storms in client logs.

Typical attack path

1. Identify NFS export containing a file near maximum supported size
2. Issue aligned READ at offset just below OFFSET_MAX from client
3. Trigger loff_t overflow in server-side offset handling
4. Receive EINVAL and force client into infinite retry loop

How to detect it

Search NFS server logs for repeated EINVAL responses to READ operations; inspect client logs for indefinite retry patterns on the same offset; correlate with processes performing large-file NFS reads; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel upgrades on all NFS servers within the next patching cycle due to 823 days since disclosure
• Restrict NFS exports to trusted clients and enforce maximum file size policies where feasible
• Enable kernel update automation and reboot orchestration for affected distributions
• Review NFS client configurations to ensure they tolerate short reads with EOF