In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade fuseUpgrade fuse3 | Aug 1, 2018 | Jul 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade fuse-develUpgrade fuse-debuginfoUpgrade fuseUpgrade fuse-libs | Apr 27, 2020 | Jul 24, 2018 |
| Amazon_linux | — | Upgrade fuse | Apr 20, 2019 | Jul 24, 2018 |
| Centos_linux | — | Upgrade fuse-debuginfoUpgrade fuse-develUpgrade fuseUpgrade fuse-libs | Aug 28, 2019 | Jul 24, 2018 |
| Debian | — | Upgrade fuse3Upgrade fuse | Jul 29, 2018 | Jul 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade fuse-libsUpgrade fuse-develUpgrade fuse | Feb 22, 2019 | Jul 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade fuseUpgrade fuse-develUpgrade fuse-libs | Dec 11, 2018 | Jul 24, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade fuse-develUpgrade fuse-libsUpgrade fuse | Jan 9, 2019 | Jul 24, 2018 |
| Oracle_linux | — | Upgrade fuseUpgrade fuse-develUpgrade fuse-libs | Jul 28, 2020 | Jul 24, 2018 |
| Redhat_linux | — | Upgrade fuseUpgrade fuse-debuginfoUpgrade fuse-develUpgrade fuse-libs | Oct 31, 2018 | Jul 24, 2018 |
| Suse | — | Upgrade libulockmgr1Upgrade fuse-devel-staticUpgrade libfuse2-32bitUpgrade fuse-docUpgrade fuse-develUpgrade fuseUpgrade libfuse2 | Oct 19, 2018 | Jul 24, 2018 |
| Ubuntu | — | Upgrade libfuse2 (Ubuntu Pro)Upgrade fuse (Ubuntu Pro) | Nov 19, 2024 | Jul 24, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub