Ubuntu update for zfs-linux

1) Improper access control

EUVDB-ID: #VU83503

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-20001

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to the network share.

The vulnerability exists due to improper validation of IPv6 addresses when an NFS share is exported to IPv6 address via the sharenfs feature. As a result, access restrictions are not applied. A remote attacker can connect to the share and gain access to files.

Mitigation

Update the affected package zfs-linux to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 23.04

libuutil1linux (Ubuntu package): before 0.8.3-1ubuntu12.16

zfsutils-linux (Ubuntu package): before 0.8.3-1ubuntu12.16

libuutil3linux (Ubuntu package): before 2.1.5-1ubuntu6~22.04.2

CPE2.3

• cpe:2.3:o:canonical:ubuntu:20.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu:23.04:*:*:*:*:*:*:*
• cpe:2.3:a:canonical:libuutil1linux_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:zfsutils-linux_ubuntu_package:*:*:*:*:*:ubuntu:*:*
• cpe:2.3:a:canonical:libuutil3linux_ubuntu_package:*:*:*:*:*:ubuntu:*:*

External links

https://ubuntu.com/security/notices/USN-6511-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.