Fix a bug that allows remote client bypass the normal

access checks when when -network or -host restrictions
are used at the same time with -mapall. [13:08]

Security:	CVE-2013-4851
Security:	FreeBSD-SA-13:08.nfsserver
Approved by:	so

2 files changed, 6 insertions, 1 deletions

diff --git a/UPDATING b/UPDATING
index a95102d9464e..d87861199ab8 100644
--- a/UPDATING
+++ b/UPDATING
@@ -15,6 +15,11 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8.x IS SLOW ON IA64 OR SUN4V:
 	debugging tools present in HEAD were left in place because
 	sun4v support still needs work to become production ready.
 
+20130429:	p9	FreeBSD-SA-13:08.nfsserver
+	Fix a bug that allows remote client bypass the normal
+	access checks when when -network or -host restrictions are
+	used at the same time with -mapall.
+
 20130429:	p8	FreeBSD-SA-13:05.nfsserver
 	Fix a bug that allows NFS clients to issue READDIR on files.
 
diff --git a/sys/kern/vfs_export.c b/sys/kern/vfs_export.c
index 4185211ec693..114c23ed5d00 100644
--- a/sys/kern/vfs_export.c
+++ b/sys/kern/vfs_export.c
@@ -208,7 +208,7 @@ vfs_hang_addrlist(struct mount *mp, struct netexport *nep,
 	np->netc_anon = crget();
 	np->netc_anon->cr_uid = argp->ex_anon.cr_uid;
 	crsetgroups(np->netc_anon, argp->ex_anon.cr_ngroups,
-	    np->netc_anon->cr_groups);
+	    argp->ex_anon.cr_groups);
 	np->netc_anon->cr_prison = &prison0;
 	prison_hold(np->netc_anon->cr_prison);
 	np->netc_numsecflavors = argp->ex_numsecflavors;