External risk intelligence

Linux Kernel NFSD Use-After-Free Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-49362

The vulnerability exists within the Linux kernel NFSD (NFS server) component. While NFS services can be exposed to the internet, they are typically restricted to internal networks or private subnets, and direct exposure of NFS to the public internet is not a standard or recommended deployment practice.

Use After Free

Linux Kernel

5.18 to before 5.18.45.19

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the Linux kernel's network file system (NFS) service. The issue involves a potential memory error that could be triggered by specific operations, and while the context suggests it's unlikely to be exposed externally, its critical severity warrants attention. The main concern is confirming relevance and exposure within your environment.

Memory safety flaw in Linux NFS service.
Critical flaw could affect sensitive data access.
Confirm if your NFS services are affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a use-after-free condition within the NFS server's file handling logic. This could occur if the NFS server is accessible, allowing an attacker to send crafted requests that lead to improper memory management, potentially enabling further malicious activities.

Requires network access to the NFS server.
Triggered by specific NFS operations.
Allows remote code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's NFS server component could potentially allow an attacker to trigger a use-after-free condition. This could affect the stability and integrity of the NFS service when handling file operations, although exploiting it would require specific, likely internal, network conditions due to the typical deployment of NFS.

NFS server file operations integrity.
Triggering a use-after-free condition.
Service instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's NFSD component is affected by a use-after-free vulnerability. Infrastructure or platform teams responsible for the Linux kernel are likely to own this issue. The first practical step is to identify all systems running the affected kernel versions, determine their exposure and business criticality, and then plan remediation with the relevant system owners, potentially involving vendor coordination for kernel updates.

Infrastructure/Platform Teams should own.
Verify affected kernel versions and reachability.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NFSD component?

The NFSD component is the Network File System server built into the Linux kernel. It allows a computer to share storage over a network, enabling other systems to mount and access files as if they were on their own local disks. It is a fundamental part of many enterprise file-sharing environments.

What does CWE-416 mean for CVE-2022-49362?

CWE-416 refers to a Use-After-Free vulnerability. In this case, the Linux kernel's file handling logic attempts to use a memory reference after that memory has already been released. If the system incorrectly tries to access this freed space, it can lead to instability or allow an attacker to interfere with system operations.

How is this memory error triggered?

The flaw is triggered by specific network requests directed at the NFS server that interact with its file management processes. It does not occur through standard, non-malicious file access; an attacker must send crafted packets that confuse the kernel's tracking of file references to induce the memory error.

Do I need to worry if my NFS server is internal?

Halo Surface Signal indicates that while the vulnerability is classified as network-based, NFS services are rarely meant for public internet exposure. If your infrastructure is properly segmented and your NFS traffic is restricted to trusted internal networks, the likelihood of an external attacker reaching the service is significantly reduced.

What should I do first to address this?

Start by identifying all servers in your environment running the affected kernel versions. Once you have an inventory, evaluate the network accessibility of these systems and prioritize updates for any instances that might be reachable from less-trusted network zones, coordinating with your platform teams to apply the necessary kernel patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.