In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libfdiskUpgrade uuiddUpgrade libblkidUpgrade util-linuxUpgrade libblkid-develUpgrade python-libmountUpgrade libuuidUpgrade util-linux-debuginfoUpgrade libmountUpgrade libmount-develUpgrade util-linux-userUpgrade libuuid-develUpgrade libsmartcolsUpgrade libfdisk-develUpgrade libsmartcols-devel | Dec 7, 2022 | Mar 7, 2018 |
| Debian | — | Upgrade util-linux | Mar 12, 2018 | Mar 6, 2018 |
| Gentoo Linux | — | Upgrade sys-apps/util-linux. | Mar 8, 2018 | Mar 6, 2018 |
| Suse | — | Upgrade util-linuxUpgrade util-linux-systemdUpgrade libuuid1-32bitUpgrade libfdisk-develUpgrade libmount1-32bitUpgrade libblkid-develUpgrade libmount-develUpgrade libuuid1Upgrade libsmartcols-develUpgrade libmount-devel-staticUpgrade libblkid-devel-32bitUpgrade libblkid1-32bitUpgrade libuuid-develUpgrade libmount-devel-32bitUpgrade libmount1Upgrade util-linux-langUpgrade libfdisk1Upgrade libblkid1Upgrade libsmartcols1Upgrade libuuid-devel-staticUpgrade libblkid-devel-staticUpgrade uuiddUpgrade libsmartcols-devel-staticUpgrade libfdisk-devel-staticUpgrade python-libmountUpgrade libuuid-devel-32bit | Jul 27, 2018 | Mar 6, 2018 |
| Ubuntu | — | Upgrade util-linux | Sep 18, 2020 | Mar 6, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub