CVE-2007-6285

Vulnerability

In autofs5 versions as shipped with Red Hat Enterprise Linux 4 and 5, the default configuration for the -hosts map does not include the nodev mount option [1][2]. This allows a remote NFS server to present special device files (e.g., /dev/mem) within the exported filesystem.

Exploitation

A local user on the autofs client can mount an NFS share from a remote server under the /net directory (since autofs automatically mounts when accessed). By operating a malicious NFS server that exports a filesystem containing device nodes, the attacker can access those devices on the client.

Impact

Successful exploitation grants the local user access to sensitive devices such as /dev/mem, potentially allowing them to read kernel memory, escalate privileges, or corrupt system memory [3]. This is a privilege escalation vulnerability.

Mitigation

Red Hat has issued updates: RHSA-2007-1177 for RHEL 4 and RHSA-2007-1176 for RHEL 5 [1][2]. The fix modifies the default autofs configuration to include the nodev option. Alternatively, administrators can manually add nodev to the -hosts map options in /etc/autofs/auto.master or /etc/auto.master.