A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade util-linux | Mar 26, 2024 | Feb 21, 2022 |
| Amazon Linux Ami 2 | — | Upgrade uuiddUpgrade util-linux-userUpgrade libsmartcolsUpgrade libfdisk-develUpgrade libsmartcols-develUpgrade python-libmountUpgrade libfdiskUpgrade util-linux-debuginfoUpgrade libuuidUpgrade libmountUpgrade util-linuxUpgrade libblkid-develUpgrade libblkidUpgrade libuuid-develUpgrade libmount-devel | Dec 7, 2022 | Feb 21, 2022 |
| Amazon_linux_2023 | — | Upgrade libfdisk-debuginfoUpgrade python3-libmount-debuginfoUpgrade libmount-develUpgrade python3-libmountUpgrade uuiddUpgrade libblkidUpgrade libblkid-debuginfoUpgrade util-linux-debugsourceUpgrade libfdisk-develUpgrade libfdiskUpgrade uuidd-debuginfoUpgrade libmount-debuginfoUpgrade util-linux-coreUpgrade libuuidUpgrade util-linux-debuginfoUpgrade libuuid-develUpgrade libmountUpgrade util-linux-core-debuginfoUpgrade util-linux-userUpgrade util-linux-user-debuginfoUpgrade libsmartcols-develUpgrade libsmartcols-debuginfoUpgrade libuuid-debuginfoUpgrade util-linuxUpgrade libsmartcolsUpgrade libblkid-devel | Feb 17, 2025 | Feb 14, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Feb 21, 2022 |
| Gentoo Linux | — | Upgrade sys-apps/util-linux. | Jan 8, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade util-linuxUpgrade libsmartcolsUpgrade libuuidUpgrade util-linux-userUpgrade libmountUpgrade libblkidUpgrade libfdisk | Jun 7, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libblkidUpgrade util-linuxUpgrade libsmartcolsUpgrade libuuidUpgrade util-linux-userUpgrade libmountUpgrade libfdisk | May 31, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade util-linuxUpgrade libuuid-develUpgrade util-linux-userUpgrade uuiddUpgrade libsmartcols-develUpgrade libmountUpgrade libfdisk-develUpgrade libfdiskUpgrade libblkid-develUpgrade libuuidUpgrade libblkidUpgrade libsmartcols | Apr 26, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libsmartcolsUpgrade libfdiskUpgrade libblkidUpgrade libmountUpgrade util-linux-userUpgrade libuuidUpgrade util-linux | Jun 16, 2022 | Feb 21, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 21, 2022 |
| Suse | — | Upgrade libblkid1Upgrade libmount1-32bitUpgrade libmount-develUpgrade util-linux-systemdUpgrade libsmartcols1Upgrade libmount1Upgrade libuuid1-32bitUpgrade util-linux-langUpgrade libblkid-develUpgrade libfdisk1Upgrade libuuid-devel-staticUpgrade libblkid-devel-staticUpgrade libuuid-develUpgrade util-linuxUpgrade libsmartcols-develUpgrade libblkid1-32bitUpgrade libfdisk-develUpgrade libuuid1 | Jun 13, 2023 | Feb 21, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub