CVE-2022-48829

What it actually does

The flaw allows improper input validation in NFSv3 SETATTR and CREATE handling where ia_size values exceeding s64_max are silently capped via min_t() in decode_sattr3(), resulting in metadata corruption or unexpected file size storage instead of error return.

Why it matters to the business

Organizations running NFSv3 servers on affected kernels risk data integrity issues and service disruptions from malformed client requests, though the issue is local-only and has seen no widespread exploitation since publication over two years ago.

How an attack unfolds

An attacker with local access to an NFSv3 server sends a SETATTR or CREATE request with an oversized file size value; the server incorrectly caps rather than rejects it, potentially leading to inconsistent file metadata that could be leveraged for denial-of-service.

How to fix it

Upgrade the Linux kernel to the commit 72c14aed6838b5d90b4dd926b6a339b34bb02e08 or later stable releases that remove the min_t() check and properly handle oversized ia_size values per the NFSv3 reference behavior.

How to confirm the fix worked

Verify the running kernel contains commit 72c14aed6838b5d90b4dd926b6a339b34bb02e08 or equivalent backport; test NFSv3 SETATTR/CREATE operations with sizes exceeding s64_max to confirm NFS3ERR_FBIG is returned instead of silent capping.

Typical attack path

1. Obtain local access to a system running an affected Linux kernel NFS server
2. Craft and send an NFSv3 SETATTR or CREATE request containing a file size larger than s64_max
3. Trigger the decode_sattr3 path that applies the erroneous min_t() cap
4. Observe or exploit resulting metadata inconsistency for availability impact

How to detect it

Review NFS server logs for anomalous SETATTR or CREATE operations, unusual file size values near or beyond s64_max boundaries, or repeated attempts that previously triggered silent capping; correlate with local process activity on the NFS host.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NFSv3 services even though exploitation is local-only and EPSS remains low
• Audit NFS server configurations to ensure only trusted local clients can issue SETATTR/CREATE
• Monitor for future CVEs in the same NFS decoding paths given the kernel's broad ecosystem reach