In the Linux kernel, the following vulnerability has been resolved:
nfsd: gate nfs3 setacl by argp->mask
nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both
ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and
argp->acl_default verbatim. The NFSv3 ACL decoder only populates
those pointers when the corresponding mask bit is set:
<pre>
nfs3svc_decode_setaclargs()
if (args->mask & NFS_ACL) decode into acl_access
if (args->mask & NFS_DFACL) decode into acl_default
/* otherwise the pointer stays NULL (pc_argzero) */
nfsd3_proc_setacl()
set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access)
set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)
</pre>
set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this
ACL type" operation. A NULL pointer that means "the client did not
send this arm" is therefore indistinguishable from "the client
asked to remove this ACL". A SETACL with mask=NFS_ACL silently
drops the directory's default ACL; mask=0 drops both.
The sibling nfsd3_proc_getacl() already consults argp->mask before
touching each arm; mirror that in setacl.
Fix by wrapping each set_posix_acl() call in the matching mask bit
check and initializing error to 0 before inode_lock so that a
request with neither bit set leaves the on-disk ACLs untouched and
returns nfs_ok. The out_drop_lock path and the unconditional
posix_acl_release() at out: are preserved; both NULL-tolerate the
skipped arms.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1
AV:N - nfsd3_proc_setacl() is NFSACL v3 SETACL (RPC program 100227) on the in-kernel NFS server, reached over TCP/UDP (typically port 2049) from a remote peer; no local syscall or physical access is required.
AC:L - A single SETACL with mask omitting NFS_ACL and/or NFS_DFACL reliably deletes the corresponding POSIX ACL; there is no race or attacker-uncontrollable layout, and CONFIG_NFSD_V3_ACL is enabled on common distro NFS server kernels.
PR:N - Default nfsd exports accept AUTH_UNIX and AUTH_NULL with no shared secret; AUTH_UNIX UIDs are attacker-chosen, so the caller spoofs the inode owner to pass inode_owner_or_capable() without any account on the server.
UI:N - The attacker triggers the flaw by sending crafted NFSACL SETACL RPCs; no victim must mount a filesystem, open a file, or otherwise interact.
S:U - Impact stays on POSIX ACL metadata of the exported filesystem in the same kernel/host security authority; this is not a VM escape, IOMMU bypass, or sandbox breakout.
C:H - Removing an access ACL drops named-user/group entries that may be the only restriction beyond mode bits, and removing a directory default ACL stops inheritance of restrictive policy, so ACL-protected file contents can become readable.
I:H - set_posix_acl(..., NULL) is the VFS remove-ACL operation, so an omitted mask bit silently deletes that ACL type on disk; mask=NFS_ACL strips the default ACL and mask=0 strips both, destroying access-control metadata.
A:N - The path performs a defined VFS ACL-remove and does not oops, panic, hang, deadlock, or leak kernel memory, so nfsd and the host remain available.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
None |
AV:N - nfsd3_proc_setacl() is NFSACL v3 SETACL (RPC program 100227) on the in-kernel NFS server, reached over TCP/UDP (typically port 2049) from a remote peer; no local syscall or physical access is required.
AC:L - A single SETACL with mask omitting NFS_ACL and/or NFS_DFACL reliably deletes the corresponding POSIX ACL; there is no race or attacker-uncontrollable layout, and CONFIG_NFSD_V3_ACL is enabled on common distro NFS server kernels.
PR:N - Default nfsd exports accept AUTH_UNIX and AUTH_NULL with no shared secret; AUTH_UNIX UIDs are attacker-chosen, so the caller spoofs the inode owner to pass inode_owner_or_capable() without any account on the server.
UI:N - The attacker triggers the flaw by sending crafted NFSACL SETACL RPCs; no victim must mount a filesystem, open a file, or otherwise interact.
S:U - Impact stays on POSIX ACL metadata of the exported filesystem in the same kernel/host security authority; this is not a VM escape, IOMMU bypass, or sandbox breakout.
C:H - Removing an access ACL drops named-user/group entries that may be the only restriction beyond mode bits, and removing a directory default ACL stops inheritance of restrictive policy, so ACL-protected file contents can become readable.
I:H - set_posix_acl(..., NULL) is the VFS remove-ACL operation, so an omitted mask bit silently deletes that ACL type on disk; mask=NFS_ACL strips the default ACL and mask=0 strips both, destroying access-control metadata.
A:N - The path performs a defined VFS ACL-remove and does not oops, panic, hang, deadlock, or leak kernel memory, so nfsd and the host remain available.
CVSS 3.1