CVE-2013-20001

What it actually does

Silent failure to parse IPv6 address data in NFS sharenfs exports causes IPv6-based access restrictions to be ignored, resulting in world-readable access instead of the configured restrictions.

Why it matters to the business

Sensitive file data on NFS shares can be read by any remote system without authentication or authorization, increasing risk of data exposure especially in environments using IPv6 addressing.

How an attack unfolds

An attacker identifies an NFS share exported with IPv6 restrictions, connects using an IPv6 address, and gains full read access because the address parsing failure silently disables the intended controls.

How to fix it

Upgrade OpenZFS to a version that correctly parses IPv6 addresses in sharenfs exports; alternatively restrict exports to IPv4 addresses or use additional network-layer controls such as firewalls until a fixed version is deployed.

How to confirm the fix worked

Review sharenfs configuration for IPv6 entries, attempt IPv6 connections from an unauthorized address after applying updates, and confirm that access is denied as configured.

Typical attack path

1. Scan for exposed NFS services on target networks
2. Identify shares configured with sharenfs IPv6 exports
3. Connect to the share using an IPv6 client address
4. Bypass intended restrictions due to parse failure and enumerate/read files

How to detect it

Inspect NFS server logs and export configurations for sharenfs entries containing IPv6 addresses; look for unexpected successful mounts or file access from IPv6 clients that should have been denied.

What your security team should do

• Prioritize upgrade of OpenZFS deployments using sharenfs with IPv6 exports
• Temporarily switch affected exports to IPv4-only or add network ACLs
• Audit current NFS export configurations for unintended world access
• Monitor for new upstream releases addressing the IPv6 parsing issue