Off-by-one error in the xlog function of mountd in the Linux NFS utils package…
Priority MEDIUM 58CWE-193Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-193 and the CVSS impact.
Summary
Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain RPC requests to mountd that do not contain newlines.
Why it matters now
EPSS 0.15784 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 2 advisories
- RHSA-2003:206 Released 2003-07-14 · Red Hat rating Important: : : Updated nfs-utils packages fix denial of service vulnerability
- Red Hat Linux 7.1
- Red Hat Linux 7.2
- Red Hat Linux 7.3
- Red Hat Linux 8.0
- Red Hat Linux 9
- RHSA-2003:207 Released 2003-07-14 · Red Hat rating Importantnfs-utils security update
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1
- Red Hat Enterprise Linux ES version 2.1
- Red Hat Enterprise Linux WS version 2.1
- Red Hat Linux Advanced Workstation 2.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AS (Advanced Server) version 2.1 | Fixed | RHSA-2003:207 |
| Red Hat Enterprise Linux ES version 2.1 | Fixed | RHSA-2003:207 |
| Red Hat Enterprise Linux WS version 2.1 | Fixed | RHSA-2003:207 |
| Red Hat Linux 7.1 | Fixed | RHSA-2003:206 |
| Red Hat Linux 7.2 | Fixed | RHSA-2003:206 |
| Red Hat Linux 7.3 | Fixed | RHSA-2003:206 |
| Red Hat Linux 8.0 | Fixed | RHSA-2003:206 |
| Red Hat Linux 9 | Fixed | RHSA-2003:206 |
| Red Hat Linux Advanced Workstation 2.1 | Fixed | RHSA-2003:207 |
Timeline
- 2026-10-02 Threatist record created from CVE-2003-0252
- 2026-10-03 Alias added: GHSA-69rx-rcww-qf58
References
Exploit 2
Advisory 10
More Linux-nfs Nfs-utils vulnerabilities
- TI-2019-02711 nfs-utils: root-owned files stored in insecure /var/lib/nfs directory CVSS 3.1CRITICAL 9.8
- TI-2011-02192 The host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before… CVSS 2.0HIGH 7.5
- TI-2025-11726 Nfs-utils: rpc.mountd in the nfs-utils privilege escalation CVSS 3.1MEDIUM 6.5
- TI-2013-01699 rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names… CVSS 2.0LOW 3.2
- TI-2011-01528 The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils… CVSS 2.0LOW 3.3
Sources
- CVE-2003-0252 · CVE Program
- CVE-2003-0252 · NVD
- FIRST EPSS
- GHSA-69rx-rcww-qf58 · GitHub Advisory Database · CC BY 4.0
- CVE-2003-0252 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences