Linux Kernel Vulnerability in NFSD Operations

CVE-2023-53680

What is CVE-2023-53680?

A vulnerability exists in the Linux kernel's Network File System Daemon (NFSD) where an improper input validation allows the function OPDESC() to be called with an out-of-bounds operation number. Specifically, the nfsd4_decode_compound() function can mistakenly invoke OPDESC() with an illegal operation number, which can lead to operational failures or security breaches due to the lack of range checking, potentially exposing the system to various threats.

References