Description
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
util-linux util-linux
>= 2.39, < 2.41.5affected>= 2.42, < 2.42.2affected
References
- https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh ↗
- https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a ↗
- https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4 ↗
- https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c ↗
- https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc ↗
- https://github.com/util-linux/util-linux/releases/tag/v2.41.5 ↗
- https://github.com/util-linux/util-linux/releases/tag/v2.42.2 ↗