CVE-2024-53073

What it actually does

The vulnerability causes a double decrement of the nn->pending_async_copies counter in the error path of nfsd4_copy() because cleanup_async_copy() already performs the decrement.

Why it matters to the business

May result in incorrect resource accounting for NFS asynchronous copy operations on affected Linux kernel versions, potentially leading to degraded NFS server stability in environments relying on copy features.

How an attack unfolds

An attacker triggers error conditions during an NFS copy operation handled by nfsd4_copy() to cause the erroneous counter decrement; no widespread exploitation or named threat actors are associated with this issue.

How to fix it

Update the Linux kernel to include commit ed98d26021db0fe62c327aa9f5e57a90bff3fa94 which prevents the erroneous decrement in the error flow of nfsd4_copy().

How to confirm the fix worked

Inspect the nfsd4_copy() function and surrounding cleanup logic in the kernel source to confirm the removal of the redundant decrement on error; test NFS copy operations under error conditions to verify stable counter behavior.

Typical attack path

1. Establish an NFS connection to a vulnerable server
2. Initiate an asynchronous copy operation that encounters an error path
3. Trigger cleanup_async_copy() execution leading to counter underflow effects

How to detect it

Review kernel logs and NFS server traces for anomalies around async copy operations or counter-related warnings; examine system behavior during NFS copy workloads for unexpected resource tracking issues.

What your security team should do

• Prioritize kernel updates for systems exposing NFS services
• Review NFS configurations to limit exposure of copy features if updates cannot be applied immediately
• Monitor kernel changelogs for related NFSD fixes in stable branches