Improper access control in zfs - CVE-2013-20001
Published: November 27, 2023
Vulnerability identifier: #VU83503
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-20001
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to the network share.
The vulnerability exists due to improper validation of IPv6 addresses when an NFS share is exported to IPv6 address via the sharenfs feature. As a result, access restrictions are not applied. A remote attacker can connect to the share and gain access to files.
Affected software
zfs
Ubuntu
zfsutils-linux (Ubuntu package)
libuutil1linux (Ubuntu package)
libuutil3linux (Ubuntu package)
Ubuntu
zfsutils-linux (Ubuntu package)
libuutil1linux (Ubuntu package)
libuutil3linux (Ubuntu package)
How to mitigate CVE-2013-20001
Install updates from vendor's website.
zfs - update to 2.0.4
zfsutils-linux (Ubuntu package) - addressed in versions 0.8.3-1ubuntu12.16, 2.1.5-1ubuntu6~22.04.2, 2.1.9-2ubuntu1.2
libuutil1linux (Ubuntu package) - update to 0.8.3-1ubuntu12.16
libuutil3linux (Ubuntu package) - addressed in versions 2.1.5-1ubuntu6~22.04.2, 2.1.9-2ubuntu1.2
zfsutils-linux (Ubuntu package) - addressed in versions 0.8.3-1ubuntu12.16, 2.1.5-1ubuntu6~22.04.2, 2.1.9-2ubuntu1.2
libuutil1linux (Ubuntu package) - update to 0.8.3-1ubuntu12.16
libuutil3linux (Ubuntu package) - addressed in versions 2.1.5-1ubuntu6~22.04.2, 2.1.9-2ubuntu1.2