Summary
It was discovered that the umount bash completion script shipped in
util-linux incorrectly handled certain mountpoints. If a local attacker
were able to create arbitrary mountpoints, another user could be tricked
into executing arbitrary code when attempting to run the umount command
with bash completion.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | util-linux | 2.31.1-0.4ubuntu3.7 |
Vulnerabilities 1
-
Unscored —
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands…
References
-
report
https://ubuntu.com/security/CVE-2018-7738