A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade util-linux | Mar 26, 2024 | Feb 21, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libmount-develUpgrade libmountUpgrade util-linuxUpgrade libuuidUpgrade libuuid-develUpgrade libsmartcolsUpgrade python-libmountUpgrade util-linux-debuginfoUpgrade libfdisk-develUpgrade libblkid-develUpgrade libsmartcols-develUpgrade libblkidUpgrade libfdiskUpgrade uuiddUpgrade util-linux-user | Dec 7, 2022 | Feb 21, 2022 |
| Amazon_linux_2023 | — | Upgrade python3-libmount-debuginfoUpgrade libmount-develUpgrade libfdiskUpgrade python3-libmountUpgrade libfdisk-debuginfoUpgrade libblkidUpgrade uuiddUpgrade libfdisk-develUpgrade uuidd-debuginfoUpgrade libblkid-debuginfoUpgrade util-linux-debugsourceUpgrade libuuidUpgrade libuuid-debuginfoUpgrade util-linux-debuginfoUpgrade libsmartcolsUpgrade libmountUpgrade util-linux-coreUpgrade libsmartcols-debuginfoUpgrade libblkid-develUpgrade util-linux-core-debuginfoUpgrade libuuid-develUpgrade util-linux-user-debuginfoUpgrade util-linuxUpgrade util-linux-userUpgrade libmount-debuginfoUpgrade libsmartcols-devel | Feb 17, 2025 | Feb 14, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Feb 21, 2022 |
| Gentoo Linux | — | Upgrade sys-apps/util-linux. | Jan 8, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libuuidUpgrade libmountUpgrade libsmartcolsUpgrade util-linux-userUpgrade util-linuxUpgrade libfdiskUpgrade libblkid | Jun 7, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libfdiskUpgrade libmountUpgrade libsmartcolsUpgrade util-linux-userUpgrade libuuidUpgrade util-linuxUpgrade libblkid | May 31, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade util-linuxUpgrade util-linux-userUpgrade uuiddUpgrade libuuid-develUpgrade libfdisk-develUpgrade libsmartcolsUpgrade libblkid-develUpgrade libmountUpgrade libfdiskUpgrade libblkidUpgrade libsmartcols-develUpgrade libuuid | Apr 26, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libmountUpgrade libsmartcolsUpgrade libfdiskUpgrade libblkidUpgrade libuuidUpgrade util-linux-userUpgrade util-linux | Jun 16, 2022 | Feb 21, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 21, 2022 |
| Suse | — | Upgrade libmount1-32bitUpgrade libsmartcols1Upgrade util-linux-systemdUpgrade util-linux-langUpgrade libblkid1Upgrade libuuid1-32bitUpgrade libmount1Upgrade libmount-develUpgrade libblkid-devel-staticUpgrade libuuid-devel-staticUpgrade libuuid-develUpgrade libblkid1-32bitUpgrade libfdisk1Upgrade libsmartcols-develUpgrade libblkid-develUpgrade libuuid1Upgrade libfdisk-develUpgrade util-linux | Jun 13, 2023 | Feb 21, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub