A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade util-linux | Mar 26, 2024 | Feb 21, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libuuid-develUpgrade libblkidUpgrade libsmartcols-develUpgrade libblkid-develUpgrade libfdiskUpgrade libmount-develUpgrade libuuidUpgrade python-libmountUpgrade util-linuxUpgrade util-linux-debuginfoUpgrade libfdisk-develUpgrade libmountUpgrade libsmartcolsUpgrade uuiddUpgrade util-linux-user | Dec 7, 2022 | Feb 21, 2022 |
| Amazon_linux_2023 | — | Upgrade libmountUpgrade libmount-debuginfoUpgrade libsmartcols-debuginfoUpgrade libblkid-develUpgrade libsmartcolsUpgrade libuuid-debuginfoUpgrade libsmartcols-develUpgrade util-linux-debuginfoUpgrade util-linux-coreUpgrade libuuidUpgrade util-linuxUpgrade util-linux-userUpgrade util-linux-user-debuginfoUpgrade libuuid-develUpgrade util-linux-core-debuginfoUpgrade uuiddUpgrade libfdisk-develUpgrade uuidd-debuginfoUpgrade python3-libmount-debuginfoUpgrade libmount-develUpgrade python3-libmountUpgrade libfdiskUpgrade libblkidUpgrade libfdisk-debuginfoUpgrade libblkid-debuginfoUpgrade util-linux-debugsource | Feb 17, 2025 | Feb 14, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Feb 21, 2022 |
| Gentoo Linux | — | Upgrade sys-apps/util-linux. | Jan 8, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsmartcolsUpgrade libuuidUpgrade util-linux-userUpgrade util-linuxUpgrade libmountUpgrade libfdiskUpgrade libblkid | Jun 7, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libuuidUpgrade libblkidUpgrade libsmartcolsUpgrade util-linuxUpgrade util-linux-userUpgrade libfdiskUpgrade libmount | May 31, 2024 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade util-linuxUpgrade util-linux-userUpgrade libuuid-develUpgrade uuiddUpgrade libuuidUpgrade libsmartcols-develUpgrade libfdiskUpgrade libfdisk-develUpgrade libsmartcolsUpgrade libblkid-develUpgrade libblkidUpgrade libmount | Apr 26, 2022 | Feb 21, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libmountUpgrade libsmartcolsUpgrade libblkidUpgrade libfdiskUpgrade util-linux-userUpgrade libuuidUpgrade util-linux | Jun 16, 2022 | Feb 21, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 21, 2022 |
| Suse | — | Upgrade libmount-develUpgrade util-linux-systemdUpgrade libmount1Upgrade libsmartcols1Upgrade libuuid1-32bitUpgrade libmount1-32bitUpgrade util-linux-langUpgrade libblkid1Upgrade libuuid-devel-staticUpgrade libsmartcols-develUpgrade libfdisk-develUpgrade util-linuxUpgrade libuuid1Upgrade libuuid-develUpgrade libblkid-devel-staticUpgrade libfdisk1Upgrade libblkid1-32bitUpgrade libblkid-devel | Jun 13, 2023 | Feb 21, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub