VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 19, 2019· Updated Sep 17, 2024

nfs-utils: root-owned files stored in insecure /var/lib/nfs directory

CVE-2019-3689

Description

The nfs-utils package on SUSE Linux Enterprise Server sets insecure permissions on /var/lib/nfs, allowing a compromised statd to trick root processes into overwriting arbitrary files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The nfs-utils package on SUSE Linux Enterprise Server sets insecure permissions on /var/lib/nfs, allowing a compromised statd to trick root processes into overwriting arbitrary files.

Vulnerability

In nfs-utils versions up to 1.3.0-34.18.1 on SUSE Linux Enterprise Server 12 and up to 2.1.1-6.10.2 on SUSE Linux Enterprise Server 15, the directory /var/lib/nfs is owned by statd:nogroup [1]. This directory contains files owned by root, such as etab, rmtab, and v4recovery. The insecure ownership allows any process with statd privileges to manipulate the directory and its contents.

Exploitation

An attacker who has compromised the statd service (or can control its actions) can place a symlink in /var/lib/nfs pointing to a target file anywhere on the system. The mountd process, which runs as root and opens rmtab following symlinks, can be tricked into creating or overwriting files at the attacker-chosen location [1].

Impact

Successful exploitation leads to arbitrary file write as root, potentially allowing privilege escalation or system compromise [1][2]. The attacker can overwrite critical system files, leading to denial of service, code execution, or full control of the system.

Mitigation

SUSE published updates for nfs-utils on 24 October 2019, changing ownership of /var/lib/nfs to root and adjusting statd to use /var/lib/nfs/sm for its data [1]. Ubuntu also released a fix in USN-4400-1 on 22 June 2020 [2]. Users should update nfs-utils to the patched versions. If patching is not possible, ensure that the statd service is not exposed to untrusted networks and limit access to the /var/lib/nfs directory.

References
  1. root-owned files stored in insecure /var/lib/nfs
  2. USN-4400-1: nfs-utils vulnerability | Ubuntu security notices | Ubuntu

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

6

News mentions

0

No linked articles in our index yet.