The vulnerability lies in the ability of a remote attacker to gain access to directories outside the NFS-exported directory via a READDIRPLUS call on the .. root exported directory.
The vulnerability was fixed in kernel 23 released on January 5.10.10, as well as in all other supported kernel versions updated on that day:
commit fdcaa4af5e70e2d984c9620a09e9dade067f2620
Author: J. Bruce Fields[email protected]>
Date: Mon Jan 11 16:01:29 2021 -0500
nfsd4: readdirplus shouldn't return parent of export
commit 51b2ee7d006a736a9126e8111d1f24e4fd0afaa6 upstream.
If you export a subdirectory of a filesystem, a READDIRPLUS on the root
of that export will return the filehandle of the parent with the ".."
entry.
The filehandle is optional, so let's just not return the filehandle for
".." if we're at the root of an export.
Note that once the client learns one filehandle outside of the export,
they can trivially access the rest of the export using further lookups.
However, it is also not very difficult to guess the filehandles outside of
the export. So exporting a subdirectory of a filesystem should
considered equivalent to providing access to the entire filesystem. To
avoid confusion, we recommend only exporting entire filesystems.
Reported by: Youjipeng[email protected]>
Signed-off-by: J. Bruce Fields[email protected]>
cc: [email protected]
Signed-off-by: Chuck Lever[email protected]>
Signed-off-by: Greg Kroah-Hartman[email protected]>
Source: linux.org.ru