CVE-2022-49362 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2022-49362?

CVE-2022-49362 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's NFSD (Network File System Daemon) that could allow an attacker to crash the kernel or potentially execute arbitrary code. It affects Linux systems running NFSD with vulnerable kernel versions. Attackers would need local access to exploit this vulnerability.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's NFSD (Network File System Daemon) that could allow an attacker to crash the kernel or potentially execute arbitrary code. It affects Linux systems running NFSD with vulnerable kernel versions. Attackers would need local access to exploit this vulnerability.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable kernel versions between the introduction of the bug and its fix; check the git commits for exact ranges.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if NFSD is enabled and running; many systems don't use NFSD by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel-level code execution, resulting in complete system compromise.

🟠

Likely Case

Kernel crash causing denial of service, requiring system reboot to restore functionality.

🟢

If Mitigated

Limited impact due to need for local access and specific NFSD usage; properly segmented systems would see minimal impact.

🌐 Internet-Facing: LOW - Requires local access to exploit, not directly reachable via network.

🏢 Internal Only: MEDIUM - Local attackers or compromised accounts could exploit this to crash systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and knowledge of kernel internals; use-after-free bugs can be challenging to exploit reliably.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits: 261eabe19cb28e4a8587a4442d257b543d7c2d57, 333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57, ada1757b259f353cade47037ee0a0249b4cddad3, b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01

Vendor Advisory: https://git.kernel.org/stable/c/261eabe19cb28e4a8587a4442d257b543d7c2d57

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable NFSD

Linux

If NFSD is not required, disable it to eliminate the attack surface.

systemctl stop nfs-server
systemctl disable nfs-server

🧯 If You Can't Patch

Disable NFSD service if not needed
Implement strict access controls to limit local user access to vulnerable systems

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions in git commits; verify if NFSD is running with 'systemctl status nfs-server' or 'ps aux | grep nfsd'.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to include the fix commits; ensure NFSD still functions properly after patch.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs in /var/log/messages or dmesg
NFSD crash logs
System reboot events without clear cause

Network Indicators:

Sudden loss of NFS service availability

SIEM Query:

Search for kernel panic events or unexpected system reboots on Linux servers running NFSD

📊 Metadata

CVE ID: CVE-2022-49362

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (11th percentile)

Published: February 26, 2025

Last Updated: March 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49362, you might also want to check these: