CVE-2024-53146

A flaw was found in the Linux kernel's Network File System daemon (NFSD). An integer overflow vulnerability exists in the callback response decoding process when handling excessively large tag lengths. A remote attacker could exploit this flaw by sending a specially crafted callback response to the NFS server, potentially resulting in a system crash and a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the system does not need to operate as an NFS server, stop and disable the nfs-server service. If the NFS server must remain active, restrict network access to trusted client hosts or networks using firewalld.

1. To disable the NFS server: systemctl stop nfs-server systemctl disable nfs-server

2. Alternatively, to restrict NFS access to a trusted subnet (e.g., 192.168.1.0/24) via firewalld: firewall-cmd --permanent --zone=public --remove-service=nfs firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24 firewall-cmd --permanent --zone=trusted --add-service=nfs firewall-cmd --reload

Caveats: Stopping the NFS service prevents remote systems from mounting or accessing exported file systems. Firewall restrictions will block any clients outside the authorized IP ranges.

Warning: Stopping the nfs-server service or reloading firewall configurations will disconnect active NFS sessions and can disrupt dependent applications.