A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade util-linux | Mar 26, 2024 | Feb 21, 2022 |
| Amazon Linux Ami 2 | — | Upgrade util-linux-userUpgrade uuiddUpgrade libsmartcols-develUpgrade libblkidUpgrade libmountUpgrade libblkid-develUpgrade libsmartcolsUpgrade libuuidUpgrade libfdisk-develUpgrade python-libmountUpgrade libmount-develUpgrade libfdiskUpgrade util-linux-debuginfoUpgrade util-linuxUpgrade libuuid-devel | Dec 7, 2022 | Feb 21, 2022 |
| Amazon_linux_2023 | — | Upgrade libsmartcolsUpgrade libmountUpgrade libblkid-develUpgrade util-linux-user-debuginfoUpgrade libsmartcols-develUpgrade util-linux-debuginfoUpgrade libuuidUpgrade libuuid-develUpgrade libsmartcols-debuginfoUpgrade libmount-debuginfoUpgrade util-linuxUpgrade util-linux-core-debuginfoUpgrade libuuid-debuginfoUpgrade util-linux-userUpgrade util-linux-coreUpgrade uuiddUpgrade libfdisk-debuginfoUpgrade python3-libmount-debuginfoUpgrade libblkidUpgrade libfdisk-develUpgrade libfdiskUpgrade util-linux-debugsourceUpgrade python3-libmountUpgrade libblkid-debuginfoUpgrade uuidd-debuginfoUpgrade libmount-devel | Feb 17, 2025 | Feb 14, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Feb 21, 2022 |
| Gentoo Linux | — | Upgrade sys-apps/util-linux. | Jan 8, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade util-linuxUpgrade util-linux-userUpgrade libsmartcolsUpgrade libuuidUpgrade libmountUpgrade libfdiskUpgrade libblkid | Jun 7, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp12 | — | Upgrade util-linuxUpgrade libuuidUpgrade libblkidUpgrade libsmartcolsUpgrade util-linux-userUpgrade libfdiskUpgrade libmount | May 31, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libfdiskUpgrade libuuidUpgrade libblkid-develUpgrade libsmartcols-develUpgrade libfdisk-develUpgrade libsmartcolsUpgrade libmountUpgrade libblkidUpgrade util-linuxUpgrade uuiddUpgrade libuuid-develUpgrade util-linux-user | Apr 26, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libmountUpgrade libblkidUpgrade libfdiskUpgrade libsmartcolsUpgrade util-linux-userUpgrade util-linuxUpgrade libuuid | Jun 16, 2022 | Feb 21, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 21, 2022 |
| Suse | — | Upgrade libuuid-devel-staticUpgrade libblkid1-32bitUpgrade libuuid-develUpgrade libuuid1Upgrade util-linuxUpgrade libblkid-devel-staticUpgrade libblkid-develUpgrade libsmartcols-develUpgrade libfdisk1Upgrade libfdisk-develUpgrade libuuid1-32bitUpgrade libmount-develUpgrade libmount1Upgrade libmount1-32bitUpgrade util-linux-langUpgrade util-linux-systemdUpgrade libsmartcols1Upgrade libblkid1 | Jun 13, 2023 | Feb 21, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub