CVE-2022-50302
Description
A flaw was found in the Linux kernel's lockd component, which handles file locking. A local user could exploit this vulnerability by interacting with re-exported NFSv3 (Network File System version 3) shares. This could cause the kernel to crash, leading to a Denial of Service (DoS) for the system.
Statement
A moderate severity flaw was found in the Linux kernel's lockd file-locking handling. When a file on a re-exported NFSv3 share is unlocked, the kernel can pass a struct file_lock that is not fully initialized (a NULL fl_file field) to vfs_lock_file(), causing a kernel Oops and crash, resulting in a denial of service. Exploitation requires local user interaction with a system that re-exports NFSv3 file systems, which is why Red Hat rates this flaw as moderate (CVSS 5.5, AV:L/AC:L/PR:L) rather than the important severity assigned in the upstream CVE record, whose network-scoped vector does not reflect the local access and privilege requirements of this issue. This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6, 7, 8, and 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 9 streams the fix has been deferred: because the flaw is a local, privilege-gated denial of service limited to NFSv3 re-export configurations, it will be addressed in a future update rather than an immediate z-stream fix, and the residual risk is a kernel crash (system denial of service) on systems that re-export NFSv3 file systems.
Mitigation
This flaw is only exposed on systems that re-export NFSv3 file systems and serve file locking on them. As a workaround, avoid NFSv3 re-exports: configure the NFS server to serve only NFSv4, for example by disabling NFSv3 with vers3=n in the [nfsd] section of /etc/nfs.conf and restarting the nfs-server service, or disable the NFS server entirely (systemctl disable --now nfs-server) if NFS services are not required. Restricting or disabling NFSv3 may impact clients that depend on NFSv3 access.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 7.5 |
| Attack Vector | Local | Local | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
