Description
smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cifs-utils | 2:5.1-1 | — |
| Debian 14 | samba | 2:3.4.7~dfsg-2 | — |
| Debian 13 | cifs-utils | 2:5.1-1 | — |
| Debian 13 | samba | 2:3.4.7~dfsg-2 | — |
| Debian 12 | cifs-utils | 2:5.1-1 | — |
| Debian 12 | samba | 2:3.4.7~dfsg-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | cifs-utils | 4.8.1-2.el6_1.2 | RHSA-2011:1221 |
| RHEL 6 | samba +11 | 3.5.6-86.el6_1.4 | RHSA-2011:1221 |
| RHEL 5 | samba +5 | 3.0.33-3.29.el5_7.4 | RHSA-2011:1219 |
| RHEL 5 | samba3x +7 | 3.5.4-0.83.el5_7.2 | RHSA-2011:1220 |
| RHEL 4 | samba +3 | 3.0.33-0.34.el4 | RHSA-2011:1219 |
Advisories 3
- RHSA-2011:1221 Red Hat Security Advisory: samba and cifs-utils security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1219 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1220 Red Hat Security Advisory: samba3x security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- [oss-security] 20110314 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110303 Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110322 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110322 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110305 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=688980
- MDVSA-2011:148 vendor-advisory
- [oss-security] 20110307 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110401 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110304 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110314 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110331 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110304 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110314 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110303 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110305 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110331 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- [oss-security] 20110315 Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE mailing-list
- samba-smbfs-security-bypass(66702) vdb-entry