PT-2021-8372 · Openzfs+3 · Openzfs+3

Sjthespian · Published 2021-02-12 · Updated 2025-04-05 · CVE-2013-20001

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenZFS versions through 2.0.3

Description An issue was discovered in OpenZFS when an NFS share is exported to IPv6 addresses via the sharenfs feature. There is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied.

Recommendations For OpenZFS versions through 2.0.3, consider disabling the sharenfs feature for IPv6 addresses until a patch is available to prevent unauthorized access. Restrict access to the NFS share to minimize the risk of exploitation. Avoid relying on IPv6 restrictions from the configuration for access control until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2013-20001

DLA-3766-1

DLA-4114-1

USN-6511-1

Affected Products

Debian

Linuxmint

Openzfs

Ubuntu

References · 18

• 🔥 https://github.com/openzfs/zfs/issues/1894#issuecomment-30693652 · Exploit
• https://osv.dev/vulnerability/DLA-4114-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-20001 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-20001 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6511-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-20001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-20001 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-20001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-20001 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-20001 · Security Note
• https://ubuntu.com/security/notices/USN-6511-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3766-1 · Vendor Advisory
• https://github.com/openzfs/zfs/releases · Note
• https://t.me/cvenotify/74196 · Telegram Post
• https://t.me/cvenotify/9901 · Telegram Post