CVE-2013-20001: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied (NVD).

The vulnerability affects the sharenfs feature in OpenZFS when handling IPv6 address data. When attempting to export an NFS share with IPv6 address restrictions, the system fails to properly parse the IPv6 address configuration. The issue has been assigned a CVSS v3.1 Base Score of 7.5 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

Due to the failure in parsing IPv6 address data, access to the NFS share is granted to all users, effectively bypassing any configured IPv6 access restrictions. This results in unauthorized access to NFS shares that were intended to be restricted (NVD).

The vulnerability can be exploited when an NFS share is configured with IPv6 address restrictions using the sharenfs feature. The issue affects all versions of OpenZFS through 2.0.3 (NVD, Debian LTS).

The issue has been fixed in subsequent releases of OpenZFS. Users are recommended to upgrade their OpenZFS installations to a version newer than 2.0.3. For Debian 10 (buster), the fix has been backported in version 0.7.12-2+deb10u3 (Debian LTS).