Description
The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | augeas | 1.0.0-1 | — |
| Debian 13 | augeas | 1.0.0-1 | — |
| Debian 12 | augeas | 1.0.0-1 | — |
| Debian 6.0 | augeas | 0.7.2-1+deb6u1 | DLA-28-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | augeas +2 | 1.0.0-5.el6 | RHSA-2013:1537 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | augeas | 1.0.0-5.el6 | RHSA-2013:1537 |
Advisories 2
- RHSA-2013:1537 Red Hat Security Advisory: augeas security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-28-1 augeas - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 55811 third-party-advisory
- http://augeas.net/news.html
- https://bugzilla.redhat.com/show_bug.cgi?id=772261
- RHSA-2013:1537 vendor-advisory
- https://github.com/hercules-team/augeas/commit/b8de6a8c