Nfs-utils: rpc.mountd in the nfs-utils privilege escalation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- nfs-utils
Version range not reported
- nfs-utils
Version range not reported
- nfs-utils
Version range not reported
- nfs-utils
Version range not reported
- nfs-utils
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- rhceph/rhceph-8-rhel9
Version range not reported
- nfs-utils
Version range not reported
- nfs-utils-lib
Version range not reported
- nfs-utils
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported