IBM AIX and PowerVM VIOS: improper authentication allows remote access to NFS exports

Impact

Improper authentication in the NFS server lets a remote attacker reach filesystems the host exports. Where an AIX or VIOS host serves shared storage to compute nodes - home directories, dataset staging, checkpoints - this is direct read access to that content without an account on the server, plus limited write-side impact per the vendor's scoring. In HPC and mixed POWER fleets those exports are usually mounted by every node in the partition, so the exposure is the whole shared namespace, not one machine. IBM's record is a single sentence and does not say which authentication path fails or whether export options such as sec=krb5 change the outcome; do not assume a mitigation that the advisory does not state.

Who can reach it

Anyone who can reach the NFS service over the network. No credentials are required (the vector records PR:N/UI:N).

What to do

Apply the fixes IBM publishes in support document 7283858 for AIX 7.2 and 7.3 and PowerVM VIOS 4.1. The record does not say whether the fix ships as a live-applicable ifix or needs the NFS service restarted or the LPAR rebooted - check the APAR before scheduling, and do not assume it is hot-applicable. In the meantime, confine the NFS service to a trusted storage VLAN and drop it at the boundary.

References