CVE-2024-49974

What it actually does

Unrestricted concurrent async COPY operations in NFSD allow clients to initiate an unbounded number of long-running background copies of 4MB chunks, exhausting server resources without limit.

Why it matters to the business

Attackers can disrupt NFS file service availability across container and Linux environments, causing operational downtime for storage-dependent workloads; widespread package impact increases urgency for patching in Rocky Linux ecosystems.

How an attack unfolds

An attacker with NFS client access sends repeated async COPY requests exceeding the intended per-namespace concurrency bound; the server processes unlimited chunks over extended periods, leading to denial of service as legitimate operations are starved.

How to fix it

Upgrade to fixed kernel versions or patched packages: fuse-overlayfs 1.4.0-2+, containernetworking-plugins 0.9.1-1+, runc 1.0.0-71+, skopeo 1.2.2-7+, cockpit-podman 29-2+, udica 0.2.4-1+, container-selinux 2.158.0-1+, podman 3.0.1-6+, slirp4netns 1.1.8-1+, criu 3.15-1+, toolbox 0.0.8-1+, buildah 1.19.7-1+, libslirp 4.3.1-1+, oci-seccomp-bpf-hook 1.2.0-1+, conmon 2.0.26-1+, crun 0.18-2+, or kernel commit 9e52ff544e0bfa09ee339fd7b0937ee3c080c24e. Enforce per-namespace concurrency limits on async COPY.

How to confirm the fix worked

Verify kernel or package versions match listed fixes; test by attempting concurrent async COPY requests and confirming NFS4ERR_DELAY responses once the namespace limit is reached.

Typical attack path

1. Establish NFSv4 client connection to target server
2. Issue multiple concurrent async COPY operations each spanning many 4MB chunks
3. Continue flooding requests to exceed any implicit resource limits
4. Observe service degradation or unresponsiveness to other clients

How to detect it

Inspect NFS server logs for repeated async COPY requests returning NFS4ERR_DELAY or patterns of high concurrent background operations from single clients; correlate with resource exhaustion events in kernel or container runtime logs.

What your security team should do

• Prioritize patching affected Rocky Linux 8 container packages and kernel immediately due to 721 days since publication
• Monitor NFS server logs for excessive async COPY activity
• Apply network controls to limit untrusted NFS client access
• Review and test per-namespace limits in staging before production rollout