Re: [PATCH 0/4] rpc.mountd CVE-2025-12801 announcement

[Steve Dickson <steved@redhat.com>]

On 3/5/26 10:59 AM, Steve Dickson wrote:
> Vulnerability discovered in rpc.mountd in the nfs-utils package
> 
> A vulnerability was recently discovered in the rpc.mountd daemon in the
> nfs-utils package for Linux, that allows a NFSv3 client to escalate the
> privileges assigned to it in the /etc/exports file at mount time. In
> particular, it allows the client to access any subdirectory or subtree
> of an exported directory, regardless of the set file permissions, and
> regardless of any 'root_squash' or 'all_squash' attributes that would
> normally be expected to apply to that client.
> 
> The vulnerability does affect all known instances of the Linux kernel
> NFS server exporting the NFSv2 and/or NFSv3 protocols. It does not
> affect those Linux kernel NFS servers that only export filesystems
> using the NFSv4 protocol.
> 
> This issue has been fixed in nfs-utils 2.8.6 and later, with an upgrade
> advised for all users.
> 
> Trond Myklebust (4):
>    mountd: Minor refactor of get_rootfh()
>    mountd: Separate lookup of the exported directory and the mount path
>    support: Add a mini-library to extract and apply RPC credentials
>    Fix access checks when mounting subdirectories in NFSv3
> 
>   aclocal/libtirpc.m4         |  12 +++
>   nfs.conf                    |   1 +
>   support/include/Makefile.am |   1 +
>   support/include/nfs_ucred.h |  44 ++++++++++
>   support/include/nfsd_path.h |   8 ++
>   support/misc/Makefile.am    |   2 +-
>   support/misc/nfsd_path.c    |  59 +++++++++++++
>   support/misc/ucred.c        | 162 ++++++++++++++++++++++++++++++++++++
>   support/nfs/Makefile.am     |   2 +-
>   support/nfs/ucred.c         | 147 ++++++++++++++++++++++++++++++++
>   utils/mountd/mountd.c       | 111 +++++++++++++++++++-----
>   utils/mountd/mountd.man     |  26 ++++++
>   12 files changed, 552 insertions(+), 23 deletions(-)
>   create mode 100644 support/include/nfs_ucred.h
>   create mode 100644 support/misc/ucred.c
>   create mode 100644 support/nfs/ucred.c
> 
Committed... (tag: nfs-utils-2-8-6-rc5)

steved.