Linux SUNRPC / NFS-over-RDMA server (svc_rdma_build_writes): svc_rdma_build_writes can walk off the end of a Write

CVE-2022-49356Firmware, BMC & network fabriccurated

Impact

svc_rdma_build_writes can walk off the end of a Write chunk's segment array, caught by KASAN as an out-of-bounds access. A client that supplies a crafted RDMA Write chunk corrupts kernel memory on the NFS server.

Who can reach it

Any NFS/RDMA client on the storage fabric.

What to do

Update the storage server kernel and reboot. Falling back to NFS over TCP removes the RDMA chunk path entirely while you schedule the reboot.

References

https://git.kernel.org/pub/scm/linux/security/vulns.git https://nvd.nist.gov/vuln/detail/CVE-2022-49356

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.