CVE-2022-48828

What it actually does

The flaw allows a u64 file size value larger than S64_MAX to be assigned directly to the signed ia_size field in nfsd_setattr, causing integer underflow and subsequent invalid file size handling in the NFS server path.

Why it matters to the business

NFS servers on affected kernels can experience unexpected crashes or availability loss when clients send oversized file attributes, increasing operational risk for file-sharing workloads until systems are updated.

How an attack unfolds

An attacker with network access to an NFSv3 or NFSv4 export sends a SETATTR or similar operation containing a file size attribute exceeding S64_MAX; decode_fattr4 stores the raw u64 value, underflow occurs in nfsd_setattr, and the kernel encounters invalid state leading to denial of service.

How to fix it

Update the Linux kernel to the commit d2211e6e34d0755f35e2f8c22d81999fa81cfc71 or later stable releases that include the nfsd_setattr underflow guard; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit d2211e6e34d0755f35e2f8c22d81999fa81cfc71 or verify that nfsd_setattr rejects oversized ia_size values before assignment; test with synthetic NFS clients sending maximum u64 sizes.

Typical attack path

1. Identify reachable NFS exports on a vulnerable kernel
2. Craft and send an NFS SETATTR request with ia_size > S64_MAX
3. Trigger underflow in nfsd_setattr and induce kernel fault or crash

How to detect it

Review kernel logs for NFS-related faults or underflow indicators around the time of NFS operations; correlate with client IP addresses performing SETATTR calls on large files.

What your security team should do

• Prioritize patching all NFS-serving kernels within standard change windows
• Monitor for kernel oops or crashes on NFS servers as a temporary detection signal
• Restrict NFS access to trusted clients until patches are applied