CVE-2016-1237

What it actually does

The nfsd kernel module permits a local user with write access to set POSIX ACLs on files, overriding the intended permission checks implemented in nfs2acl.c, nfs3acl.c, and nfs4acl.c and resulting in unauthorized disclosure of file contents.

Why it matters to the business

Organizations running unpatched Linux kernels with NFS exports may experience unauthorized data exposure from files that should have been protected by standard permissions, increasing the risk of data leakage in shared environments.

How an attack unfolds

A local attacker with an account on the system crafts a POSIX ACL that grants read access and applies it to a target file served by nfsd; the flawed ACL handling code accepts the change without enforcing the original permission model, allowing the attacker to read restricted content over NFS.

How to fix it

Upgrade the Linux kernel to a version containing commit 999653786df6954a31044528ac3f7a5dadca08f4 or later; rebuild and reboot affected systems, then verify that nfsd no longer permits unauthorized ACL modifications on exported files.

How to confirm the fix worked

Confirm the running kernel contains commit 999653786df6954a31044528ac3f7a5dadca08f4 or a backport; test by attempting to set a permissive ACL as a non-owner user and verify that access remains denied.

Typical attack path

1. Obtain a local user account on a system exporting NFS shares
2. Identify a file whose contents are restricted by discretionary permissions
3. Use setfacl or equivalent to apply a permissive POSIX ACL on the file
4. Access the file contents via an NFS mount from the same host or another client

How to detect it

Review system logs for unexpected ACL modifications on NFS-exported paths and correlate with user activity around file access times; examine auditd or kernel logs for setxattr or acl-related operations on exported directories.

What your security team should do

• Prioritize kernel updates on any systems still running versions prior to the referenced fix
• Audit NFS exports to ensure they are limited to trusted clients and minimal required permissions
• Disable unnecessary NFS services where possible to reduce the attack surface