NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3): Export policy rules marked read-only are not

Impact

Export policy rules marked read-only are not actually enforced, so an authenticated SMB client writes to volumes the operator believed were read-only. Shared read-only dataset shares become writable, which means one tenant can poison training data everyone else consumes.

Who can reach it

An authenticated SMBv2 or SMBv3 client of a Clustered Data ONTAP 8.3 release-candidate system. The attacker needs no more than the read access they were legitimately granted.

What to do

Move off the affected 8.3 RC builds to a fixed ONTAP release. Afterwards, verify write behaviour empirically against each read-only export rather than trusting the policy display, and check the volumes for unexpected modifications.

References