In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade fuseUpgrade fuse3 | Aug 1, 2018 | Jul 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade fuse-develUpgrade fuse-debuginfoUpgrade fuseUpgrade fuse-libs | Apr 27, 2020 | Jul 24, 2018 |
| Amazon_linux | — | Upgrade fuse | Apr 20, 2019 | Jul 24, 2018 |
| Centos_linux | — | Upgrade fuse-libsUpgrade fuseUpgrade fuse-develUpgrade fuse-debuginfo | Aug 28, 2019 | Jul 24, 2018 |
| Debian | — | Upgrade fuseUpgrade fuse3 | Jul 29, 2018 | Jul 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade fuse-libsUpgrade fuse-develUpgrade fuse | Feb 22, 2019 | Jul 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade fuse-develUpgrade fuseUpgrade fuse-libs | Dec 11, 2018 | Jul 24, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade fuse-develUpgrade fuse-libsUpgrade fuse | Jan 9, 2019 | Jul 24, 2018 |
| Oracle_linux | — | Upgrade fuseUpgrade fuse-libsUpgrade fuse-devel | Jul 28, 2020 | Jul 24, 2018 |
| Redhat_linux | — | Upgrade fuseUpgrade fuse-debuginfoUpgrade fuse-libsUpgrade fuse-devel | Oct 31, 2018 | Jul 24, 2018 |
| Suse | — | Upgrade fuseUpgrade libfuse2-32bitUpgrade libfuse2Upgrade fuse-docUpgrade fuse-develUpgrade libulockmgr1Upgrade fuse-devel-static | Oct 19, 2018 | Jul 24, 2018 |
| Ubuntu | — | Upgrade libfuse2 (Ubuntu Pro)Upgrade fuse (Ubuntu Pro) | Nov 19, 2024 | Jul 24, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub