Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.

XF:nfs-mknod(78) | URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/78