util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged
user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges.
This issue is fixed in 2.41.5 and 2.42.2.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 8
https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a…
security-advisories@github.com
https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d1…
security-advisories@github.com
https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5…
security-advisories@github.com
https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33e…
security-advisories@github.com
https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610d…
security-advisories@github.com
https://github.com/util-linux/util-linux/releases/tag/v2.41.5
security-advisories@github.com
https://github.com/util-linux/util-linux/releases/tag/v2.42.2
security-advisories@github.com
https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx
security-advisories@github.com