NFSv4 Uninitialized Label Crash in Linux Kernel - CVE-2022-49418
Summary
CVE-2022-49418: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and security. This vulnerability affects the NFSv4 (Network File System version 4) implementation within the kernel, which allows for file sharing over a network. The specific issue arises from an uninitialized label during referral lookups, potentially leading to system crashes.
Vulnerability Detail
CVE-2022-49418 is a vulnerability in the Linux kernel that occurs when the NFSv4 subsystem attempts to handle referral lookups without properly initializing the nfs4_label. This oversight can lead to a crash, as evidenced by the panic log generated during operations like listing directory contents (e.g., using the 'ls' command). The crash can disrupt services and impact system stability, especially in environments relying on NFS for file sharing.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2022-49418 is a significant vulnerability in the Linux kernel that affects the NFSv4 subsystem, leading to potential system crashes. It is crucial to update to the patched version 5.18.5-1 to mitigate this risk. Users are encouraged to monitor their systems and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49418 is a vulnerability in the Linux kernel's NFSv4 subsystem that can lead to system crashes due to uninitialized labels during referral lookups.
This vulnerability can cause crashes when performing file operations over NFS, potentially disrupting services and affecting system stability.
Yes, the patched version of the Linux package is 5.18.5-1 for Debian 12 and 13. Updating to this version will resolve the issue.
While no specific workarounds are available, it is advisable to monitor your system for any unusual behavior and apply the patch as soon as possible.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
