In the Linux kernel, the following vulnerability has been resolved:
nfsd: gate nfs2 setacl by argp->mask
The NFSACL v2 SETACL path shares the decoder convention used by its
v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access
only when NFS_ACL is set in the request mask and argp->acl_default
only when NFS_DFACL is set, leaving the other pointer NULL because
the argument buffer is zeroed up to pc_argzero before decode.
nfsacld_proc_setacl() then hands both pointers to set_posix_acl()
unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS
"remove this ACL type" operation, so an omitted arm is
indistinguishable from an explicit request to delete that ACL. A
SETACL carrying only NFS_ACL silently strips the directory's default
ACL; mask=0 strips both.
This is the same defect just fixed in nfsd3_proc_setacl(); apply the
same remedy. Gate each set_posix_acl() call on its mask bit and
initialize error to 0 so that a request with neither bit set leaves
the on-disk ACLs untouched and returns success. The out_drop_lock
path and the unconditional posix_acl_release() in
nfsaclsvc_release_setacl() already tolerate the skipped arms.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1
AV:N - The flaw is in nfsd NFSACL v2 SETACL (RPC program 100227, ACLPROC2_SETACL) in nfsacld_proc_setacl(); a remote NFS client reaches it over TCP/UDP 2049 via svc_process to nfsd_dispatch and nfsaclsvc_decode_setaclargs.
AC:L - The attacker supplies the SETACL mask and filehandle. A request with only NFS_ACL, only NFS_DFACL, or mask=0 leaves the omitted posix_acl pointer NULL (pc_argzero), and set_posix_acl() treats NULL as delete with no race or uninfluencable victim state.
PR:N - Typical AUTH_SYS nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can MOUNT/LOOKUP and send SETACL with a spoofed AUTH_UNIX owner uid so nfsd_setuser() and inode_owner_or_capable() succeed without a local account.
UI:N - The attacking NFS client sends the SETACL RPC itself; no local user or administrator action on the NFS server, such as mounting a filesystem or opening a file, is required at attack time.
S:U - Unintended set_posix_acl(NULL) only removes POSIX ACL xattrs on the exported filesystem of the nfsd host; impact stays in that kernel/filesystem security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - Silently deleting a directory default ACL (SETACL with only NFS_ACL, or mask=0 stripping both) drops inheritance so new files are governed only by mode/umask, allowing a remote client to READ subsequently created data those default ACLs were meant to keep confidential.
I:H - nfsacld_proc_setacl() calls set_posix_acl(..., NULL) for every ACL type omitted from the mask, which is the VFS delete operation, so an attacker-chosen inode can have its access ACL, default ACL, or both completely removed and later writes those ACLs would have denied.
A:N - This is an unintended POSIX ACL deletion through the normal set_posix_acl(NULL) remove path; it does not oops, panic, hang, deadlock, or leak memory, so the NFS server and host remain available.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
None |
AV:N - The flaw is in nfsd NFSACL v2 SETACL (RPC program 100227, ACLPROC2_SETACL) in nfsacld_proc_setacl(); a remote NFS client reaches it over TCP/UDP 2049 via svc_process to nfsd_dispatch and nfsaclsvc_decode_setaclargs.
AC:L - The attacker supplies the SETACL mask and filehandle. A request with only NFS_ACL, only NFS_DFACL, or mask=0 leaves the omitted posix_acl pointer NULL (pc_argzero), and set_posix_acl() treats NULL as delete with no race or uninfluencable victim state.
PR:N - Typical AUTH_SYS nfsd exports do not cryptographically verify RPC credentials; any host allowed by the export can MOUNT/LOOKUP and send SETACL with a spoofed AUTH_UNIX owner uid so nfsd_setuser() and inode_owner_or_capable() succeed without a local account.
UI:N - The attacking NFS client sends the SETACL RPC itself; no local user or administrator action on the NFS server, such as mounting a filesystem or opening a file, is required at attack time.
S:U - Unintended set_posix_acl(NULL) only removes POSIX ACL xattrs on the exported filesystem of the nfsd host; impact stays in that kernel/filesystem security authority and does not cross a VM, IOMMU, or sandbox boundary.
C:H - Silently deleting a directory default ACL (SETACL with only NFS_ACL, or mask=0 stripping both) drops inheritance so new files are governed only by mode/umask, allowing a remote client to READ subsequently created data those default ACLs were meant to keep confidential.
I:H - nfsacld_proc_setacl() calls set_posix_acl(..., NULL) for every ACL type omitted from the mask, which is the VFS delete operation, so an attacker-chosen inode can have its access ACL, default ACL, or both completely removed and later writes those ACLs would have denied.
A:N - This is an unintended POSIX ACL deletion through the normal set_posix_acl(NULL) remove path; it does not oops, panic, hang, deadlock, or leak memory, so the NFS server and host remain available.
CVSS 3.1