In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libuuid-develUpgrade util-linux-userUpgrade libblkid-develUpgrade libmount-develUpgrade libsmartcols-develUpgrade libmountUpgrade libuuidUpgrade util-linuxUpgrade libsmartcolsUpgrade libfdisk-develUpgrade python-libmountUpgrade util-linux-debuginfoUpgrade libblkidUpgrade libfdiskUpgrade uuidd | Dec 7, 2022 | Mar 7, 2018 |
| Debian | — | Upgrade util-linux | Mar 12, 2018 | Mar 6, 2018 |
| Gentoo Linux | — | Upgrade sys-apps/util-linux. | Mar 8, 2018 | Mar 6, 2018 |
| Suse | — | Upgrade libmount-develUpgrade libuuid1Upgrade libmount1-32bitUpgrade libfdisk-develUpgrade libblkid-develUpgrade util-linuxUpgrade util-linux-systemdUpgrade libsmartcols-develUpgrade libuuid1-32bitUpgrade libuuid-devel-32bitUpgrade libmount-devel-staticUpgrade libfdisk1Upgrade python-libmountUpgrade libsmartcols-devel-staticUpgrade libfdisk-devel-staticUpgrade libblkid1Upgrade libmount1Upgrade libuuid-develUpgrade libblkid1-32bitUpgrade libblkid-devel-32bitUpgrade uuiddUpgrade libblkid-devel-staticUpgrade libmount-devel-32bitUpgrade util-linux-langUpgrade libuuid-devel-staticUpgrade libsmartcols1 | Jul 27, 2018 | Mar 6, 2018 |
| Ubuntu | — | Upgrade util-linux | Sep 18, 2020 | Mar 6, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub