Rapid7 Vulnerability & Exploit Database

Oracle Linux: (CVE-2022-43945) (Multiple Advisories): kernel security and bug fix update

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Oracle Linux: (CVE-2022-43945) (Multiple Advisories): kernel security and bug fix update

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
11/04/2022
Created
01/26/2023
Added
01/25/2023
Modified
02/23/2023

Description

The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Solution(s)

  • oracle-linux-upgrade-kernel

References

  • ELSA-2023-0832
  • CVE-2022-43945
  • USN-5754-1
  • USN-5754-2
  • USN-5755-1
  • USN-5755-2
  • USN-5773-1
  • USN-5779-1
  • USN-5789-1
  • USN-5794-1
  • USN-5802-1
  • USN-5804-1
  • USN-5804-2
  • USN-5808-1
  • USN-5813-1
View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;