14 results · Feed
-
High 7.0
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privil…
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 7.0
util-linux mount hook_owner TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount …
-
High 7.8
util-linux libmount Privilege Escalation via Failed Mount Helper
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owne…
-
High 7.0
Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted…
-
High 7.8
Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to…
-
High 7.9
Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from th…
-
Medium 4.7
util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates …
-
Medium 6.1
Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
-
Low 3.3CVE-2024-28085 Public exploit
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to oth…
-
Medium 5.5
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmou…
-
Unscored —
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmou…
-
Medium 5.5
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library us…
-
Unscored —
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to us…