Description
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.13-8 | — |
| Debian 13 | util-linux | 2.13-8 | — |
| Debian 12 | util-linux | 2.13-8 | — |
| Debian 5.0 | loop-aes-utils | 2.12r-16+lenny1 | DTSA-70-1 |
| Debian 5.0 | util-linux | 2.12r-19+lenny1 | DTSA-64-1 |
| Debian 4.0 | loop-aes-utils | 2.12r-15+etch1 | DSA-1449-1 |
| Debian 4.0 | util-linux | 2.12r-19etch1 | DSA-1450-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | util-linux +1 | 2.12p-4sarge2 | DSA-1450-1, DSA-1449-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | util-linux | 2.13-0.45.el5_1.1 | RHSA-2007:0969 |
| RHEL 4 | util-linux | 2.12a-17.el4_6.1 | RHSA-2007:0969 |
| RHEL 3 | mount +2 | 2.11y-31.24 | RHSA-2007:0969 |
Advisories 5
- RHSA-2007:0969 Red Hat Security Advisory: util-linux security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1449-1 loop-aes-utils privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-64-1 util-linux - privilege escalation in mount / umount Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1450-1 util-linux privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-70-1 loop-aes-utils - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-533-1 vendor-advisory
- https://issues.rpath.com/browse/RPL-1757
- 27145 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=195390
- 27122 third-party-advisory
- MDKSA-2007:198 vendor-advisory
- http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=ebbeb2c7ac1b00b6083905957837a271e80b187e
- 28349 third-party-advisory
- DSA-1449 vendor-advisory
- DSA-1450 vendor-advisory
- 27104 third-party-advisory
- 27283 third-party-advisory
- 20080108 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- 27354 third-party-advisory
- [Security-announce] 20080107 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list
- 28469 third-party-advisory
- GLSA-200710-18 vendor-advisory
- 28348 third-party-advisory
- 1018782 vdb-entry
- FEDORA-2007-2462 vendor-advisory
- 27687 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=320041
- 28368 third-party-advisory
- 27399 third-party-advisory
- oval:org.mitre.oval:def:10101 vdb-entry signature
- 25973 vdb-entry
- 27188 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-023.htm
- ADV-2007-3417 vdb-entry
- RHSA-2007:0969 vendor-advisory
- SUSE-SR:2007:022 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2008-0001.html
- ADV-2008-0064 vdb-entry
- 20080123 UPDATED VMSA-2008-0001.1 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages mailing-list