Linux NFS server (nfsd, NFSv4 file creation ACL): When a client sets an ACL during NFSv4 file creation, nfsd silently

Impact

When a client sets an ACL during NFSv4 file creation, nfsd silently drops it and falls back to an ACL derived from the mode bits. Files a tenant believed were restricted to a named principal are actually governed by looser mode-derived permissions, so other users on the shared export can read them.

Who can reach it

Any NFSv4 client creating files with an ACL naming a principal. The exposure is created by the server, not by an attacker action - the attacker just has to be another user on the export.

What to do

Update the storage server kernel to one carrying the nfsd_create_setattr ACL fix and reboot. Then re-apply ACLs on files created during the exposure window, since the intended ACLs were never written to the inodes.

References