Description
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
util-linux util-linux
>= 2.39.1, < 2.41.5affected>= 2.42, < 2.42.2affected
References
- https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx ↗
- https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661 ↗
- https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9 ↗
- https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4 ↗
- https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f ↗
- https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1 ↗
- https://github.com/util-linux/util-linux/releases/tag/v2.41.5 ↗
- https://github.com/util-linux/util-linux/releases/tag/v2.42.2 ↗