[PATCH 0/4] rpc.mountd CVE-2025-12801 announcement

[Steve Dickson <steved@redhat.com>]

Vulnerability discovered in rpc.mountd in the nfs-utils package

A vulnerability was recently discovered in the rpc.mountd daemon in the
nfs-utils package for Linux, that allows a NFSv3 client to escalate the
privileges assigned to it in the /etc/exports file at mount time. In
particular, it allows the client to access any subdirectory or subtree
of an exported directory, regardless of the set file permissions, and
regardless of any 'root_squash' or 'all_squash' attributes that would
normally be expected to apply to that client.

The vulnerability does affect all known instances of the Linux kernel
NFS server exporting the NFSv2 and/or NFSv3 protocols. It does not
affect those Linux kernel NFS servers that only export filesystems
using the NFSv4 protocol.

This issue has been fixed in nfs-utils 2.8.6 and later, with an upgrade
advised for all users.

Trond Myklebust (4):
  mountd: Minor refactor of get_rootfh()
  mountd: Separate lookup of the exported directory and the mount path
  support: Add a mini-library to extract and apply RPC credentials
  Fix access checks when mounting subdirectories in NFSv3

 aclocal/libtirpc.m4         |  12 +++
 nfs.conf                    |   1 +
 support/include/Makefile.am |   1 +
 support/include/nfs_ucred.h |  44 ++++++++++
 support/include/nfsd_path.h |   8 ++
 support/misc/Makefile.am    |   2 +-
 support/misc/nfsd_path.c    |  59 +++++++++++++
 support/misc/ucred.c        | 162 ++++++++++++++++++++++++++++++++++++
 support/nfs/Makefile.am     |   2 +-
 support/nfs/ucred.c         | 147 ++++++++++++++++++++++++++++++++
 utils/mountd/mountd.c       | 111 +++++++++++++++++++-----
 utils/mountd/mountd.man     |  26 ++++++
 12 files changed, 552 insertions(+), 23 deletions(-)
 create mode 100644 support/include/nfs_ucred.h
 create mode 100644 support/misc/ucred.c
 create mode 100644 support/nfs/ucred.c

-- 
2.53.0