CVE-2019-3689

What it actually does

Incorrect ownership of /var/lib/nfs allows a process running as statd to create or overwrite arbitrary files with root privileges.

Why it matters to the business

Compromise of a single service account can lead to full system takeover, data corruption, or persistent unauthorized access across Linux environments using the affected packages.

How an attack unfolds

An attacker first gains control of the statd process through another vulnerability or misconfiguration, then abuses the directory ownership to trick root-owned processes into writing attacker-controlled files anywhere on the filesystem.

How to fix it

Upgrade gradle to the versions listed in the fixed_versions field for each distribution or repository; ensure /var/lib/nfs and its contents are owned by root after the update and restrict statd access.

How to confirm the fix worked

Verify package versions match the fixed releases, inspect directory ownership with stat and ls commands, and confirm no files inside /var/lib/nfs are writable by the statd user.

Typical attack path

1. Identify hosts running nfs-utils with the vulnerable directory ownership
2. Compromise the statd user account via network or local vector
3. Use statd privileges to create or modify files in /var/lib/nfs that are processed by root
4. Trigger root processes to consume the attacker-supplied files for privilege escalation or persistence

How to detect it

Review system logs for unexpected file creations or modifications under /var/lib/nfs by the statd user, correlate with authentication or process execution events indicating statd compromise, and scan for newly written files owned by root that originated from statd activity.

What your security team should do

• Apply the listed fixed package versions immediately on all affected systems
• Audit nfs-related services for unnecessary exposure and disable where possible
• Monitor for new EPSS increases or exploit publications given the high CVSS score
• Implement file integrity monitoring on /var/lib/nfs and related directories