Skip to content
OpenAdvisories
Unscored USN-3246-1 1 CVE

eject vulnerability

Published Mar 27, 2017 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Ilja Van Sprundel discovered that dmcrypt-get-device incorrectly checked setuid
and setgid return values. A local attacker could use this issue to execute code
as an administrator.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS eject 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1
Ubuntu · 16.04 LTS 16.04:LTS eject 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1

Vulnerabilities 1

  • Unscored —
    CVE-2017-6964

    dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) se…

    eject Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-6964