CVE-2025-68242
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's NFS implementation involves improper verification of user IDs when delegated timestamps are enabled. Specifically, the nfs_setattr function does not check if the inode's UID matches the caller's filesystem UID when modifying access and modification times (atime and mtime). This can cause certain tests (utimes01 and utime06) to fail when the 'nobody' user ID attempts to modify these timestamps. The issue is fixed by adding a UID check and forwarding the request to the server for permission verification if the UIDs do not match.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized modification of file timestamps (atime and mtime) on NFS-mounted filesystems when delegated timestamps are enabled. If an attacker or unprivileged user can exploit this, they might alter file metadata without proper permission checks, potentially affecting file integrity, auditing, and system behavior that relies on accurate timestamps.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the failure of the utimes01 and utime06 LTP tests when delegated timestamps are enabled. The following commands can be used to detect the issue: # echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06 If these tests fail, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that adds a UID check in nfs_setattr to verify the inode's UID against the caller's fsuid when delegated timestamps are permitted. If the UIDs do not match, the request is sent to the server for permission checking. Until the patch is applied, consider disabling delegated timestamps or restricting NFS exports to trusted users to reduce risk.