CVE-2024-53073

A flaw was found in the Linux kernel's Network File System daemon (NFSD). When an error occurs during an asynchronous copy operation, the system improperly decrements the pending copy counter multiple times. An attacker could exploit this issue by triggering specific error paths during copy requests, causing counter corruption that can lead to a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue on systems that do not need to operate as an NFS server, stop and disable the NFS server daemon. If the NFS server must remain operational, restrict network access to the NFS port (TCP/UDP 2049) to trusted client networks only using firewall rules.

1. Stop and disable the NFS service:

systemctl stop nfs-server.service
systemctl disable nfs-server.service

2. Alternatively, limit exposure by removing general NFS access from the default firewall zone:

firewall-cmd --permanent --remove-service=nfs
firewall-cmd --reload

Caveats: Stopping the NFS server completely prevents clients from mounting or accessing exports. Modifying firewall rules will reject incoming requests from unauthorized networks.

Warning: Executing these commands will disrupt active NFS client sessions and reload network filtering services.