Description
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | util-linux | Fixed in util-linux v2.37.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | util-linux | 2.37.3-1 | — |
| Debian 13 | util-linux | 2.37.3-1 | — |
| Debian 12 | util-linux | 2.37.3-1 | — |
| Debian 11 | util-linux | 2.36.1-8+deb11u1 | DSA-5055-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | util-linux | 2.37.2-4ubuntu2 | — |
| Ubuntu 20.04 LTS | util-linux | 2.34-0.1ubuntu9.3 | USN-5279-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | libeconf | 0.4.4+git20220104.962774f-150300.3.6.2 | SUSE-SU-2022:0727-1 |
| SLES 15 SP3 | shadow | 4.8.1-150300.4.3.8 | SUSE-SU-2022:0727-1 |
| SLES 15 SP3 | util-linux | 2.36.2-150300.4.14.3 | SUSE-SU-2022:0727-1 |
| SLES 15 SP3 | util-linux-systemd | 2.36.2-150300.4.14.2 | SUSE-SU-2022:0727-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.2 | libeconf | 0.4.4+git20220104.962774f-150300.3.6.2 | SUSE-SU-2022:0727-2 |
| SLE Micro 5.2 | shadow | 4.8.1-150300.4.3.8 | SUSE-SU-2022:0727-2 |
| SLE Micro 5.2 | util-linux | 2.36.2-150300.4.14.3 | SUSE-SU-2022:0727-2 |
| SLE Micro 5.2 | util-linux-systemd | 2.36.2-150300.4.14.2 | SUSE-SU-2022:0727-2 |
| SLE Micro 5.1 | libeconf | 0.4.4+git20220104.962774f-150300.3.6.2 | SUSE-SU-2022:0727-1 |
| SLE Micro 5.1 | shadow | 4.8.1-150300.4.3.8 | SUSE-SU-2022:0727-1 |
| SLE Micro 5.1 | util-linux | 2.36.2-150300.4.14.3 | SUSE-SU-2022:0727-1 |
| SLE Micro 5.1 | util-linux-systemd | 2.36.2-150300.4.14.2 | SUSE-SU-2022:0727-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | util-linux | 2.37.3-1.1 | openSUSE-SU-2024:11784-1 |
| openSUSE Leap 15.3 | libeconf | 0.4.4+git20220104.962774f-150300.3.6.2 | openSUSE-SU-2022:0727-1 |
| openSUSE Leap 15.3 | python3-libmount +1 | 2.36.2-150300.4.14.2 | openSUSE-SU-2022:0727-1 |
| openSUSE Leap 15.3 | shadow | 4.8.1-150300.4.3.8 | openSUSE-SU-2022:0727-1 |
| openSUSE Leap 15.3 | util-linux | 2.36.2-150300.4.14.3 | openSUSE-SU-2022:0727-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | util-linux | 2.37.3-r0 | — |
| Alpine v3.23 | util-linux | 2.37.3-r0 | — |
| Alpine v3.22 | util-linux | 2.37.3-r0 | — |
| Alpine v3.21 | util-linux | 2.37.3-r0 | — |
| Alpine v3.20 | util-linux | 2.37.3-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | util-linux | 2.37.3-r0 | — |
| Alpine v3.18 | util-linux | 2.37.3-r0 | — |
| Alpine v3.17 | util-linux | 2.37.3-r0 | — |
| Alpine v3.16 | util-linux | 2.37.3-r0 | — |
| Alpine v3.15 | util-linux | 2.37.3-r0 | — |
| Alpine v3.14 | util-linux | 2.37.3-r0 | — |
| Alpine v3.13 | util-linux | 2.37.3-r0 | — |
| Alpine v3.12 | util-linux | 2.37.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | uuidd +14 | 2.37.4-1.amzn2023.0.3 | ALAS2023-2023-024 |
Advisories 8
- USN-5279-1 util-linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5055-1 util-linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11784-1 libblkid-devel-2.37.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0727-1 Security update for libeconf, shadow and util-linux SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0727-2 Security update for libeconf, shadow and util-linux SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0727-1 Security update for libeconf, shadow and util-linux SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0279 util-linux: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 7, 2024
- ALAS2023-2023-024 Moderate: util-linux security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
References
- https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes
- https://github.com/util-linux/util-linux/commit/166e87368ae88bf31112a30e078cceae637f4cdb
- https://www.openwall.com/lists/oss-security/2022/01/24/2
- https://bugzilla.redhat.com/show_bug.cgi?id=2024628
- https://access.redhat.com/security/cve/CVE-2021-3996
- [oss-security] 20221130 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) mailing-list
- 20221208 Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) mailing-list
- http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
- https://security.netapp.com/advisory/ntap-20221209-0002/
- GLSA-202401-08 vendor-advisory