Description
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-15lenny3 | DSA-1809-1 |
| Debian 5.0 | user-mode-linux | 2.6.26-1um-2+15lenny3 | DSA-1809-1 |
| Debian 4.0 | fai-kernels | 1.17+etch.24etch3 | DSA-1865-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-24etch3 | DSA-1865-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.8etch2 | DSA-1844-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.24etch3 | DSA-1865-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-128.1.14.el5 | RHSA-2009:1106 |
| RHEL 4 | kernel +10 | 2.6.9-89.0.3.EL | RHSA-2009:1132 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-126.el5rt | RHSA-2009:1157 |
Advisories 6
- RHSA-2009:1157 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1132 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1106 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1844-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1865-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1809-1 linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2009:135 vendor-advisory
- DSA-1865 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0111
- [linux-nfs] 20090509 [NFS] [PATCH] nfs: Fix NFS v4 client handling of MAY_EXEC in nfs_permission. mailing-list
- 34934 vdb-entry
- 37471 third-party-advisory
- [nfsv4] 20061116 Status of execute permissions in NFSv4 ACLs ? mailing-list
- [oss-security] 20090513 CVE request: kernel: problem with NFS v4 client handling of MAY_EXEC in nfs_permission mailing-list
- MDVSA-2009:148 vendor-advisory
- 35656 third-party-advisory
- oval:org.mitre.oval:def:9990 vdb-entry signature
- DSA-1844 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- ADV-2009-1331 vdb-entry
- RHSA-2009:1157 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=500297
- 35106 third-party-advisory
- 20090724 rPSA-2009-0111-1 kernel mailing-list
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 36051 third-party-advisory
- 35298 third-party-advisory
- 36327 third-party-advisory
- oval:org.mitre.oval:def:8543 vdb-entry signature
- SUSE-SA:2009:031 vendor-advisory
- http://bugzilla.linux-nfs.org/show_bug.cgi?id=131
- USN-793-1 vendor-advisory
- [nfsv4] 20061117 [Patch] Re: Status of execute permissions in NFSv4 ACLs ? mailing-list
- SUSE-SA:2009:038 vendor-advisory
- ADV-2009-3316 vdb-entry
- 35394 third-party-advisory
- DSA-1809 vendor-advisory
- 35847 third-party-advisory