Description
The vfs_hang_addrlist function in sys/kern/vfs_export.c in the NFS server implementation in the kernel in FreeBSD 8.3 and 9.x through 9.1-RELEASE-p5 controls authorization for host/subnet export entries on the basis of group information sent by the client, which allows remote attackers to bypass file permissions on NFS filesystems via crafted requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | kfreebsd-9 | 9.0-10+deb70.3 | DSA-2743-1 |
Advisories 1
- DSA-2743-1 kfreebsd-9 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://svnweb.freebsd.org/base?view=revision&revision=244226
- FreeBSD-SA-13:08 vendor-advisory
- 61484 vdb-entry