Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2025-12801

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-nfs Redhat
Products
Nfs-utils Ceph Storage Enterprise Linux and 5 more
CVE-2003-0252

security flaw

Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.

CVSS 3.1 · 9.8 Critical EPSS 15.8% KEV · Not listed
Vendors
Linux-nfs Redhat
Products
Nfs-utils Enterprise Linux Linux
CVE-2011-1749

nfs-utils: mount.nfs fails to anticipate RLIMIT_FSIZE

The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Linux-nfs Redhat
Products
Nfs-utils Enterprise Linux
CVE-2011-2500

nfs-utils: Improper authentication of an incoming request when an IP based authentication used

The host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before 1.2.4 does not properly use DNS to verify access to NFS exports, which allows remote attackers to mount filesystems by establishing crafted DNS A and PTR records.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Linux-nfs Redhat
Products
Nfs-utils Enterprise Linux
CVE-2013-1923

nfs-utils: rpc.gssd is vulnerable to DNS spoofing

rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.

CVSS 2.0 · 3.2 Low EPSS 1.1% KEV · Not listed
Vendors
Linux-nfs
Products
Nfs-utils
CVE-2019-3689

nfs-utils: root-owned files stored in insecure /var/lib/nfs directory

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.

CVSS 3.1 · 5.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Linux-nfs Suse
Products
Nfs-utils Linux Enterprise Server