Описание
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Never decrement pending_async_copies on error
The error flow in nfsd4_copy() calls cleanup_async_copy(), which
already decrements nn->pending_async_copies.
A flaw was found in the Linux kernel's Network File System daemon (NFSD). When an error occurs during an asynchronous copy operation, the system improperly decrements the pending copy counter multiple times. An attacker could exploit this issue by triggering specific error paths during copy requests, causing counter corruption that can lead to a Denial of Service (DoS).
Меры по смягчению последствий
To mitigate this issue on systems that do not need to operate as an NFS server, stop and disable the NFS server daemon. If the NFS server must remain operational, restrict network access to the NFS port (TCP/UDP 2049) to trusted client networks only using firewall rules.
- Stop and disable the NFS service:
- Alternatively, limit exposure by removing general NFS access from the default firewall zone:
Caveats: Stopping the NFS server completely prevents clients from mounting or accessing exports. Modifying firewall rules will reject incoming requests from unauthorized networks. Warning: Executing these commands will disrupt active NFS client sessions and reload network filtering services.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Will not fix | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Will not fix | ||
| Red Hat Enterprise Linux 9 | kernel | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pending_async_copies on error The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pending_async_copies on error The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.
In the Linux kernel, the following vulnerability has been resolved: N ...
In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pending_async_copies on error The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.
Уязвимость функции nfsd4_copy() модуля fs/nfsd/nfs4proc.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.5 Medium
CVSS3