Summary
[2.5.4-38.0.1.el9_7.3]
- spec: remove multiple warnings when upgrading nfs-utils with gssproxy [Orabug: 36044562]
[2.5.4-38.3]
- Add requires for selinux-policy (RHEL-127104)
[2.5.4-38.2]
- Replace statfs64 with statfs (RHEL-127104)
- NFS export symlink vulnerability fix (RHEL-127104)
- mountd: Minor refactor of get_rootfh() (RHEL-127104)
- mountd: Separate lookup of the exported directory and the mount path (RHEL-127104)
- support: Add a mini-library to extract and apply RPC credentials (RHEL-127104)
- Fix access checks when mounting subdirectories in NFSv3 (RHEL-127104)
Resolves: CVE-2025-12801
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | libnfsidmap | 1:2.5.4-38.0.1.el9_7.3 |
| Oracle Linux · 9 | libnfsidmap-devel | 1:2.5.4-38.0.1.el9_7.3 |
| Oracle Linux · 9 | nfs-utils | 1:2.5.4-38.0.1.el9_7.3 |
| Oracle Linux · 9 | nfs-utils-coreos | 1:2.5.4-38.0.1.el9_7.3 |
| Oracle Linux · 9 | nfsv4-client-utils | 1:2.5.4-38.0.1.el9_7.3 |
Vulnerabilities 1
-
Medium 6.5
Nfs-utils: rpc.mountd in the nfs-utils privilege escalation
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any…